Executive brief
H2O-3 is an open-source machine learning platform used for data analysis and model building. A critical security flaw in its database import interface allows an unauthenticated attacker to execute malicious code on the server. This could lead to a complete system takeover, unauthorized access to sensitive datasets, and disruption of data science operations.
Technical details
A remote code execution (RCE) vulnerability exists in the /99/ImportSQLTable REST API endpoint of H2O-3. The application implements a blacklist to block dangerous JDBC parameters, but the filter was historically limited to MySQL-specific parameters. An unauthenticated attacker can bypass these controls by supplying a PostgreSQL JDBC URL (jdbc:postgresql:) and utilizing driver-specific parameters such as 'socketFactory' and 'socketFactoryArg' to instantiate arbitrary Java classes. This allows for the execution of arbitrary code with the privileges of the H2O-3 process. The vulnerability is addressed in version 3.46.0.10 by expanding the disallowed parameter list.
Affected products
- H2O.ai H2O-3 3.46.0.9 and prior
Timeline
- 2026-04-23: disclosed
- 2026-04-23: advisory
- 2026-05-19: other: NIST analysis completed