Is CVE-2026-3960 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3960 being exploited in the wild.

How severe is CVE-2026-3960?

Critical severity, with a CVSS score of 9.8, published 23 April 2026.

Which products and versions are affected?

H2O.ai H2O-3 3.46.0.9 and prior; ai.h2o:h2o-core (Maven) ECOSYSTEM:introduced=0,fixed=3.46.0.10; h2o (PyPI) ECOSYSTEM:introduced=0,fixed=3.46.0.10.

Is there a fix for CVE-2026-3960?

Yes. ai.h2o:h2o-core (Maven): upgrade to 3.46.0.10 or later; h2o (PyPI): upgrade to 3.46.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3960 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3960?

Check whether you run H2O.ai H2O-3, ai.h2o:h2o-core (Maven) or h2o (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3960: H2O.ai H2O-3 remote code execution in ImportSQLTable API

CVE-2026-3960 · Severity: critical · CVSS 9.8 · Published 2026-04-23

H2O-3 is an open-source machine learning platform used for data analysis and model building. A critical security flaw in its database import interface allows an unauthenticated attacker to execute malicious code on the server. This could lead to a complete system takeover, unauthorized access to sensitive datasets, and disruption of data science operations.

Technologies: H2O.ai H2O-3, ai.h2o:h2o-core (Maven), h2o (PyPI). Vendors: H2O.ai, Maven, PyPI.

Quick answers

Is CVE-2026-3960 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3960 being exploited in the wild.
How severe is CVE-2026-3960?: Critical severity, with a CVSS score of 9.8, published 23 April 2026.
Which products and versions are affected?: H2O.ai H2O-3 3.46.0.9 and prior; ai.h2o:h2o-core (Maven) ECOSYSTEM:introduced=0,fixed=3.46.0.10; h2o (PyPI) ECOSYSTEM:introduced=0,fixed=3.46.0.10.
Is there a fix for CVE-2026-3960?: Yes. ai.h2o:h2o-core (Maven): upgrade to 3.46.0.10 or later; h2o (PyPI): upgrade to 3.46.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3960 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3960?: Check whether you run H2O.ai H2O-3, ai.h2o:h2o-core (Maven) or h2o (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ai.h2o:h2o-core (Maven): upgrade to 3.46.0.10 or later

# set ai.h2o:h2o-core to 3.46.0.10 in your pom.xml or build.gradle

h2o (PyPI): upgrade to 3.46.0.10 or later
```
pip install "h2o>=3.46.0.10"
```

Technical details

A remote code execution (RCE) vulnerability exists in the /99/ImportSQLTable REST API endpoint of H2O-3. The application implements a blacklist to block dangerous JDBC parameters, but the filter was historically limited to MySQL-specific parameters. An unauthenticated attacker can bypass these controls by supplying a PostgreSQL JDBC URL (jdbc:postgresql:) and utilizing driver-specific parameters such as 'socketFactory' and 'socketFactoryArg' to instantiate arbitrary Java classes. This allows for the execution of arbitrary code with the privileges of the H2O-3 process. The vulnerability is addressed in version 3.46.0.10 by expanding the disallowed parameter list.

Affected products

H2O.ai H2O-3 3.46.0.9 and prior

Identifiers

CVE-2026-3960
GHSA-qmcv-hh7c-3m56
PYSEC-2026-2180

Timeline

2026-04-23: disclosed
2026-04-23: advisory
2026-05-19: other: NIST analysis completed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.