H2Oai vulnerabilities

30 vulnerabilities

Known vulnerabilities in H2Oai products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.

Products

3
PrioritiseCVE-2026-65700h2oai · h2ogpth2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files APIh2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string unsanitized as a path component via os.path.join, and because the default API key is EMPTY authentication is bypassed, enabling attackers to traverse outside the intended user directory through the file content, delete, and upload endpoints to achieve remote code execution by writing to startup hooks or application-loaded files.CVSS9.8CriticalEPSS1.52%RoutineCVE-2026-8752h2oai · h2o-3 +1 moreh2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access controlA weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java of the component Rapids setproperty Primitive Handler. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.CVSS6.9MediumEPSS0.31%RoutineCVE-2026-8751h2oai · h2o-3 +1 moreh2oai h2o-3 JAR Model.java importBinaryModel deserializationA security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.CVSS9.8CriticalEPSS0.41%RoutineCVE-2026-8750h2oai · h2o-3 +1 moreh2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosureA vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/PersistNFS.java of the component ImportFile API. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS7.5HighEPSS0.50%RoutineCVE-2026-3960h2oai · h2oai/h2o-3 +3 moreRemote Code Execution in h2oai/h2o-3A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific dangerous parameters. An attacker can bypass these controls by switching the JDBC URL protocol to jdbc:postgresql: and exploiting PostgreSQL JDBC driver-specific parameters such as socketFactory and socketFactoryArg. This allows unauthenticated attackers to execute arbitrary code on the H2O-3 server with the privileges of the H2O-3 process. The issue is resolved in version 3.46.0.10.CVSS9.8CriticalEPSS0.94%PrioritiseCVE-2024-5986h2oai · h2oai/h2o-3 +2 moreRemote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `/3/Parse` endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the `/3/Frames/framename/export` endpoint. The impact of this vulnerability includes the potential for remote code execution and complete access to the system running h2o-3, as attackers can overwrite critical files such as private SSH keys or script files.CVSS9.1CriticalEPSS0.70%RoutineCVE-2025-10769h2oai · h2o-3 +1 moreh2oai h2o-3 H2 JDBC Driver ImportSQLTable deserializationA vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connection_url leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS9.8CriticalEPSS0.54%RoutineCVE-2025-10768h2oai · h2o-3 +1 moreh2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserializationA flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS9.8CriticalEPSS0.44%PrioritiseCVE-2025-6544h2oai · h2oai/h2o-3 +3 moreDeserialization Vulnerability in h2oai/h2o-3A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.CVSS9.8CriticalEPSS0.95%PrioritiseCVE-2025-5662h2oai · h2oai/h2o-3Deserialization Vulnerability in h2oai/h2o-3A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present in the MySQL JDBC Driver version 8.0.19 and JDK version 8u112. The issue is resolved in version 3.46.0.8.CVSS9.8CriticalEPSS0.69%PrioritiseCVE-2025-6507h2oai · h2oai/h2o-3Deserialization of Untrusted Data in h2oai/h2o-3A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution and reading of system files. This issue affects the latest master branch version 3.47.0.99999. The vulnerability arises from the ability to bypass regular expression filters intended to prevent malicious parameter injection in JDBC connections. Attackers can manipulate spaces between parameters to evade detection, allowing for unauthorized file access and code execution. The vulnerability is addressed in version 3.46.0.8.CVSS9.8CriticalEPSS17.27%PrioritiseCVE-2024-10549h2oai · h2oai/h2o-3 +3 moreDenial of Service by ReDOS in h2oai/h2o-3A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service.CVSS7.5HighEPSS0.64%PrioritiseCVE-2024-8062h2oai · h2oai/h2o-3 +3 moreDenial of Service in h2oai/h2o-3A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs, causing the application to block and become unresponsive to other requests.CVSS7.5HighEPSS0.48%PrioritiseCVE-2024-7768h2oai · h2oai/h2o-3 +3 moreDenial of Service in h2oai/h2o-3A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.CVSS7.5HighEPSS0.79%RoutineCVE-2024-6863h2oai · h2oai/h2o-3 +3 moreEncryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption.CVSS6.5MediumEPSS0.36%PrioritiseCVE-2024-8616h2oai · h2oai/h2o-3 +3 moreArbitrary File Overwrite in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.CVSS8.2HighEPSS0.56%PrioritiseCVE-2024-10550h2oai · h2oai/h2o-3 +3 moreDenial of Service by ReDOS in h2oai/h2o-3A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.CVSS7.5HighEPSS0.64%PrioritiseCVE-2024-6854h2oai · h2oai/h2o-3 +3 moreArbitrary File Overwrite in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.CVSS7.1HighEPSS0.78%PrioritiseCVE-2024-10572h2oai · h2oai/h2o-3 +3 moreDenial of Service and Arbitrary File Write in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.CVSS7.5HighEPSS0.69%PrioritiseCVE-2024-10553h2oai · h2oai/h2o-3 +3 moreJdbc Deserialization in h2oai/h2o-3A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.CVSS9.8CriticalEPSS1.59%