# CVE-2026-3960: H2O.ai H2O-3 remote code execution in ImportSQLTable API

Source: https://junglewise.ai/threats/cve-2026-3960-h2o-ai-h2o-3-remote-code-execution-in-importsqltable-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-3960 · Severity: critical · CVSS 9.8 · Published 2026-04-23

H2O-3 is an open-source machine learning platform used for data analysis and model building. A critical security flaw in its database import interface allows an unauthenticated attacker to execute malicious code on the server. This could lead to a complete system takeover, unauthorized access to sensitive datasets, and disruption of data science operations.

Technologies: [H2O.ai H2O-3](https://junglewise.ai/threats/technologies/h2o-3), [ai.h2o:h2o-core (Maven)](https://junglewise.ai/threats/technologies/ai-h2o-h2o-core), [h2o (PyPI)](https://junglewise.ai/threats/technologies/h2o). Vendors: [H2O.ai](https://junglewise.ai/threats/vendors/h2o-ai), [Maven](https://junglewise.ai/threats/vendors/maven), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-3960 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3960 being exploited in the wild.

**How severe is CVE-2026-3960?** Critical severity, with a CVSS score of 9.8, published 23 April 2026.

**Which products and versions are affected?** H2O.ai H2O-3 3.46.0.9 and prior; ai.h2o:h2o-core (Maven) ECOSYSTEM:introduced=0,fixed=3.46.0.10; h2o (PyPI) ECOSYSTEM:introduced=0,fixed=3.46.0.10.

**Is there a fix for CVE-2026-3960?** Yes. ai.h2o:h2o-core (Maven): upgrade to 3.46.0.10 or later; h2o (PyPI): upgrade to 3.46.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3960 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3960?** Check whether you run H2O.ai H2O-3, ai.h2o:h2o-core (Maven) or h2o (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ai.h2o:h2o-core (Maven): upgrade to 3.46.0.10 or later

  ```sh
  # set ai.h2o:h2o-core to 3.46.0.10 in your pom.xml or build.gradle
  ```

- h2o (PyPI): upgrade to 3.46.0.10 or later

  ```sh
  pip install "h2o>=3.46.0.10"
  ```


## Technical details

A remote code execution (RCE) vulnerability exists in the /99/ImportSQLTable REST API endpoint of H2O-3. The application implements a blacklist to block dangerous JDBC parameters, but the filter was historically limited to MySQL-specific parameters. An unauthenticated attacker can bypass these controls by supplying a PostgreSQL JDBC URL (jdbc:postgresql:) and utilizing driver-specific parameters such as 'socketFactory' and 'socketFactoryArg' to instantiate arbitrary Java classes. This allows for the execution of arbitrary code with the privileges of the H2O-3 process. The vulnerability is addressed in version 3.46.0.10 by expanding the disallowed parameter list.

## Affected products

- H2O.ai H2O-3 3.46.0.9 and prior

## Identifiers

- CVE-2026-3960
- GHSA-qmcv-hh7c-3m56
- PYSEC-2026-2180

## Timeline

- 2026-04-23: disclosed
- 2026-04-23: advisory
- 2026-05-19: other: NIST analysis completed

## References

- [https://github.com/h2oai/h2o-3/commit/b9ae2d3c5220db2dc53753357a783e590364d044](https://github.com/h2oai/h2o-3/commit/b9ae2d3c5220db2dc53753357a783e590364d044)
- [https://huntr.com/bounties/6954fe04-b905-453f-8c53-205ac8377e0d](https://huntr.com/bounties/6954fe04-b905-453f-8c53-205ac8377e0d)

## Related threats

- [PYSEC-2026-1441 - H2O Vulnerable to Arbitrary File Overwrite](https://junglewise.ai/threats/cve-2024-8616-h2o-vulnerable-to-arbitrary-file-overwrite)
- [PYSEC-2026-1438 - H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request](https://junglewise.ai/threats/cve-2024-8062-h2o-vulnerable-to-denial-of-service-dos-via-head-request)
- [PYSEC-2026-1443 - H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint](https://junglewise.ai/threats/cve-2024-7768-h2o-vulnerable-to-denial-of-service-dos-via-3-importfiles-endpoint)
- [PYSEC-2026-1439 - H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing](https://junglewise.ai/threats/cve-2024-7765-h2o-vulnerable-to-denial-of-service-dos-via-large-gzip-parsing)
- [PYSEC-2026-1442 - H2O Vulnerable to Execution of Arbitrary Files](https://junglewise.ai/threats/cve-2024-6863-h2o-vulnerable-to-execution-of-arbitrary-files)