Is there a public PoC exploit available for CVE-2026-8752?

Yes, a public proof-of-concept exploit is available for CVE-2026-8752. Prioritise patching immediately. EPSS: 0.0%.

H2O-3 CVE-2026-8752

Q: What is the CVSS score of CVE-2026-8752?

CVE-2026-8752 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30699 MEDIUM

Improper Access Control (CWE-284)

2026-05-17 VulDB

GHSA-cq43-78ch-3f5q

Authentication Bypass Java

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 17, 2026 - 12:30 vuln.today

CVSS changed

May 17, 2026 - 12:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java of the component Rapids setproperty Primitive Handler. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper access controls in H2O-3's Rapids setproperty primitive allow remote unauthenticated attackers to modify system properties via the AstSetProperty.java exec function. The vulnerability permits low-impact integrity violations through manipulation of configuration settings accessible via the Rapids API. Public exploit code is available (VulDB 364379), increasing exploitation risk, though no active exploitation confirmed by CISA KEV at time of analysis. EPSS data not provided. Vendor unresponsive to disclosure attempts.

Technical ContextAI

H2O-3 is an open-source machine learning platform by H2O.ai, written in Java. The vulnerability resides in the Rapids expression language interpreter, specifically the setproperty primitive handler (AstSetProperty.java in h2o-core module). CWE-284 (Improper Access Control) indicates the exec function fails to validate authorization before allowing property modifications. Rapids is H2O-3's DSL for data manipulation and model building, typically exposed via REST API endpoints. The affected component processes user-supplied commands to set internal JVM or application properties without adequate permission checks, enabling unauthorized configuration changes.

RemediationAI

No vendor-released patch identified at time of analysis - vendor unresponsive to early disclosure attempts per VulDB submission 810108. Deployers must implement compensating controls: (1) Restrict network access to H2O-3 Rapids API endpoints using firewall rules, allowing only trusted IP ranges or internal networks (reduces attack surface but limits legitimate remote usage). (2) Deploy H2O-3 behind authentication proxy (e.g., nginx with OAuth2, API gateway with key validation) to enforce authentication before Rapids API access (introduces deployment complexity and potential performance overhead). (3) If Rapids setproperty functionality not required for use cases, consider custom code review to disable or remove AstSetProperty class from deployment (requires Java expertise and testing; may break dependent features). (4) Monitor H2O-3 logs for unexpected setproperty invocations, establishing baseline of legitimate property changes (detective control only, does not prevent exploitation). For production environments, combination of network segmentation (control 1) and authentication proxy (control 2) recommended until official patch available. Track H2O.ai GitHub repository (https://github.com/h2oai/h2o-3) for community-developed fixes.