# CVE-2026-8752: H2Oai H2O-3 improper access control in Rapids setproperty

Source: https://junglewise.ai/threats/cve-2026-8752-h2oai-h2o-3-improper-access-control-in-rapids-setproperty  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2026-8752 · Severity: medium · CVSS 5.3 · Published 2026-05-17

A security vulnerability exists in H2O-3, a popular open-source machine learning platform. An unauthenticated attacker can remotely bypass security restrictions to enable a disabled feature that allows the import and execution of custom Java code (POJOs). This could allow an attacker to take full control of the server, access sensitive data, or disrupt machine learning operations.

Technologies: [H2O.ai H2O-3](https://junglewise.ai/threats/technologies/h2o-3). Vendors: [H2O.ai](https://junglewise.ai/threats/vendors/h2o-ai).

## Quick answers

**Is CVE-2026-8752 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8752 being exploited in the wild.

**How severe is CVE-2026-8752?** Medium severity, with a CVSS score of 5.3, published 17 May 2026.

**Which products and versions are affected?** H2O.ai H2O-3 up to 7402.

**Is there a fix for CVE-2026-8752?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8752 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8752?** Check whether you run H2O.ai H2O-3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A critical logic flaw exists in the H2O-3 Rapids engine due to the public exposure of the 'setproperty' primitive via the /99/Rapids endpoint. This endpoint allows unauthenticated users to modify internal system properties across all cluster nodes. An attacker can exploit this to toggle the 'sys.ai.h2o.pojo.import.enabled' property to 'true', bypassing a default security gate designed to prevent the import of potentially malicious Java objects. Once enabled, the attacker can upload a malicious POJO source file and trigger its compilation and instantiation via the /3/ModelBuilders/generic endpoint, resulting in arbitrary code execution within the server environment. The vendor was reportedly contacted but has not provided a patch; remediation involves restricting access to debugging primitives and making security-sensitive properties immutable at runtime.

## Affected products

- h2oai h2o-3 up to 7402

## Timeline

- 2026-05-17: advisory: Vulnerability disclosed via VulDB and NVD
- 2026-05-17: disclosed: Public exploit details released

## References

- [https://vuldb.com/submit/810108](https://vuldb.com/submit/810108)
- [https://vuldb.com/vuln/364379](https://vuldb.com/vuln/364379)
- [https://vuldb.com/vuln/364379/cti](https://vuldb.com/vuln/364379/cti)
- [https://vulnplus-note.wetolink.com/share/pyVa0GWPuAZE](https://vulnplus-note.wetolink.com/share/pyVa0GWPuAZE)

## Related threats

- [h2oai h2o-3 insecure deserialization in importBinaryModel](https://junglewise.ai/threats/cve-2026-8751-h2oai-h2o-3-insecure-deserialization-in-importbinarymodel)
- [h2oai h2o-3 path traversal in ImportFiles API](https://junglewise.ai/threats/cve-2026-8750-h2oai-h2o-3-path-traversal-in-importfiles-api)
- [H2O.ai H2O-3 remote code execution in ImportSQLTable API](https://junglewise.ai/threats/cve-2026-3960-h2o-ai-h2o-3-remote-code-execution-in-importsqltable-api)
- [h2oai h2o-3 arbitrary file overwrite via path traversal](https://junglewise.ai/threats/cve-2023-6569-h2oai-h2o-3-arbitrary-file-overwrite-via-path-traversal)