Executive brief
H2O-3 is an open-source machine learning platform used for building and deploying predictive models. A security vulnerability in its model import feature allows an attacker to upload and execute malicious code on the server. This could lead to a complete takeover of the server, theft of sensitive data, or disruption of business operations.
Technical details
A pre-authentication insecure deserialization vulnerability exists in H2O-3's 'importBinaryModel' function within 'h2o-core/src/main/java/hex/Model.java'. The vulnerability stems from the use of 'Keyed.readAll()' on untrusted model bytes, which allows an attacker to restore a serialized 'custom_metric_func' reference. By first uploading a malicious JAR to the Distributed Key-Value (DKV) store via '/3/PutKey.bin', an attacker can craft a binary model that, when imported and subsequently used for scoring, triggers the 'DkvClassLoader' to load and execute the attacker-controlled JAR. This results in arbitrary code execution within the server JVM. The vendor has reportedly not responded to the disclosure, and public exploits are available.
Affected products
- h2oai h2o-3 up to 7402
Timeline
- 2026-05-17: advisory: Initial disclosure via VulDB and NVD