# CVE-2026-8751: h2oai h2o-3 insecure deserialization in importBinaryModel

Source: https://junglewise.ai/threats/cve-2026-8751-h2oai-h2o-3-insecure-deserialization-in-importbinarymodel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2026-8751 · Severity: high · CVSS 7.3 · Published 2026-05-17

H2O-3 is an open-source machine learning platform used for building and deploying predictive models. A security vulnerability in its model import feature allows an attacker to upload and execute malicious code on the server. This could lead to a complete takeover of the server, theft of sensitive data, or disruption of business operations.

Technologies: [H2O.ai H2O-3](https://junglewise.ai/threats/technologies/h2o-3). Vendors: [H2O.ai](https://junglewise.ai/threats/vendors/h2o-ai).

## Quick answers

**Is CVE-2026-8751 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8751 being exploited in the wild.

**How severe is CVE-2026-8751?** High severity, with a CVSS score of 7.3, published 17 May 2026.

**Which products and versions are affected?** H2O.ai H2O-3 up to 7402.

**Is there a fix for CVE-2026-8751?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8751 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8751?** Check whether you run H2O.ai H2O-3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A pre-authentication insecure deserialization vulnerability exists in H2O-3's 'importBinaryModel' function within 'h2o-core/src/main/java/hex/Model.java'. The vulnerability stems from the use of 'Keyed.readAll()' on untrusted model bytes, which allows an attacker to restore a serialized 'custom_metric_func' reference. By first uploading a malicious JAR to the Distributed Key-Value (DKV) store via '/3/PutKey.bin', an attacker can craft a binary model that, when imported and subsequently used for scoring, triggers the 'DkvClassLoader' to load and execute the attacker-controlled JAR. This results in arbitrary code execution within the server JVM. The vendor has reportedly not responded to the disclosure, and public exploits are available.

## Affected products

- h2oai h2o-3 up to 7402

## Timeline

- 2026-05-17: advisory: Initial disclosure via VulDB and NVD

## References

- [https://vuldb.com/submit/810107](https://vuldb.com/submit/810107)
- [https://vuldb.com/vuln/364378](https://vuldb.com/vuln/364378)
- [https://vuldb.com/vuln/364378/cti](https://vuldb.com/vuln/364378/cti)
- [https://vulnplus-note.wetolink.com/share/b5nsQg6EcsBS](https://vulnplus-note.wetolink.com/share/b5nsQg6EcsBS)

## Related threats

- [H2Oai H2O-3 improper access control in Rapids setproperty](https://junglewise.ai/threats/cve-2026-8752-h2oai-h2o-3-improper-access-control-in-rapids-setproperty)
- [h2oai h2o-3 path traversal in ImportFiles API](https://junglewise.ai/threats/cve-2026-8750-h2oai-h2o-3-path-traversal-in-importfiles-api)
- [H2O.ai H2O-3 remote code execution in ImportSQLTable API](https://junglewise.ai/threats/cve-2026-3960-h2o-ai-h2o-3-remote-code-execution-in-importsqltable-api)
- [h2oai h2o-3 arbitrary file overwrite via path traversal](https://junglewise.ai/threats/cve-2023-6569-h2oai-h2o-3-arbitrary-file-overwrite-via-path-traversal)