What is the CVSS score of CVE-2026-3960?

CVE-2026-3960 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of H2O-3 are affected by CVE-2026-3960?

H2O-3 machine learning platform versions through 3.46.0.9 are vulnerable to unauthenticated remote code execution through a REST API endpoint, putting any organization running this software with…. A patch is available.

How to fix or mitigate CVE-2026-3960?

Within 24 hours: Inventory all H2O-3 installations, confirm which are running versions 3.46.0.9 or earlier, and document which are accessible from untrusted networks. Within 7 days: Apply the vendor-released patch to all affected instances; consult the official H2O-3 security advisory for the patched version number and deployment instructions specific to your infrastructure. Within 30 days: Verify patch deployment via application version checks and review audit logs for any signs of exploitation attempts against the /99/ImportSQLTable endpoint prior to patching.

H2O-3 CVE-2026-3960

EUVD-2026-25205 CRITICAL

Code Injection (CWE-94)

2026-04-23 @huntr_ai

GHSA-qmcv-hh7c-3m56

PostgreSQL Code Injection RCE

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 22:13 vuln.today

Analysis Updated

May 19, 2026 - 22:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 19, 2026 - 22:07 vuln.today

cvss_changed

Severity Changed

May 19, 2026 - 22:07 NVD

MEDIUM CRITICAL

CVSS changed

May 19, 2026 - 22:07 NVD

5.9 (MEDIUM) 9.8 (CRITICAL)

Patch released

Apr 24, 2026 - 14:50 nvd

Patch available

Apr 23, 2026 - 11:01 EUVD

Analysis Generated

Apr 23, 2026 - 10:31 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 10:00 euvd

EUVD-2026-25205

Analysis Generated

Apr 23, 2026 - 10:00 vuln.today

CVE Published

Apr 23, 2026 - 08:47 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

20 maven packages depend on ai.h2o:h2o-core (20 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.46.0.10.

DescriptionCVE.org

A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific dangerous parameters. An attacker can bypass these controls by switching the JDBC URL protocol to jdbc:postgresql: and exploiting PostgreSQL JDBC driver-specific parameters such as socketFactory and socketFactoryArg. This allows unauthenticated attackers to execute arbitrary code on the H2O-3 server with the privileges of the H2O-3 process. The issue is resolved in version 3.46.0.10.

AnalysisAI

Remote code execution in H2O-3 versions 3.46.0.9 and earlier allows unauthenticated attackers to execute arbitrary code via the /99/ImportSQLTable REST API by abusing PostgreSQL JDBC driver parameters that bypass an incomplete MySQL-only parameter blacklist. No active exploitation is recorded in CISA KEV and EPSS is low (0.19%), but a vendor patch is available and SSVC marks exploitation status as POC, indicating proof-of-concept-grade attacker capability against a network-reachable endpoint.

Technical ContextAI

H2O-3 is an open-source distributed machine learning platform from H2O.ai (CPE cpe:2.3:a:h2oai:h2oai/h2o-3) that exposes a REST API including /99/ImportSQLTable, which accepts JDBC connection URLs and uses water.jdbc.SQLManager to validate them. The root cause is CWE-94 (Code Injection): SQLManager.validateJdbcUrl maintained a denylist of dangerous JDBC parameters that only enumerated MySQL-specific options (autoDeserialize, queryInterceptors, allowLoadLocalInfile, etc.), so an attacker who switches the URL scheme from jdbc:mysql: to jdbc:postgresql: can supply PostgreSQL-driver-specific parameters such as socketFactory and socketFactoryArg, which the PostgreSQL JDBC driver instantiates as arbitrary Java classes (for example org.springframework.context.support.ClassPathXmlApplicationContext loading a remote XML bean definition), yielding code execution inside the H2O-3 JVM. The fix commit b9ae2d3c5220db2dc53753357a783e590364d044 extends the blacklist to include socketFactory, socketFactoryArg, sslfactory, sslfactoryarg, statementInterceptors, loggerLevel, and loggerFile.

RemediationAI

Vendor-released patch: H2O-3 3.46.0.10, which extends the SQLManager JDBC parameter blacklist to cover PostgreSQL-driver options (socketFactory, socketFactoryArg, sslfactory, sslfactoryarg, statementInterceptors, loggerLevel, loggerFile) per commit b9ae2d3c5220db2dc53753357a783e590364d044 - upgrade all H2O-3 nodes to 3.46.0.10 or later as the primary fix. Until upgrade, restrict network access to the H2O-3 REST API (default port 54321) so that only trusted clients can reach /99/ImportSQLTable, for example by binding the service to localhost or placing it behind an authenticating reverse proxy or VPN; the trade-off is that legitimate remote data-science clients will lose direct access and must route through the proxy. As an additional compensating control, block outbound network connections from the H2O-3 host to untrusted destinations to hinder the second-stage fetch of malicious XML/class payloads referenced by socketFactoryArg or loggerFile, accepting that this may break legitimate JDBC connectivity to remote databases. Advisory and patch details: https://huntr.com/bounties/6954fe04-b905-453f-8c53-205ac8377e0d and https://github.com/h2oai/h2o-3/commit/b9ae2d3c5220db2dc53753357a783e590364d044.