CVE-2026-3960
published 2026-04-23CVE-2026-3960: A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The…
PriorityP276critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.94%
56.4th percentile
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific dangerous parameters. An attacker can bypass these controls by switching the JDBC URL protocol to jdbc:postgresql: and exploiting PostgreSQL JDBC driver-specific parameters such as socketFactory and socketFactoryArg. This allows unauthenticated attackers to execute arbitrary code on the H2O-3 server with the privileges of the H2O-3 process. The issue is resolved in version 3.46.0.10.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| h2o | h2o | < 3.46.0.10 | 3.46.0.10 |
| h2oai | h2oai_h2o-3 | >= unspecified < 3.46.0.10 | 3.46.0.10 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qmcv-hh7c-3m56: A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3
ghsa_unreviewed·2026-04-23
CVE-2026-3960 [MEDIUM] CWE-94 GHSA-qmcv-hh7c-3m56: A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific dangerous parameters. An attacker can bypass these controls by switching the JDBC URL protocol to jdbc:postgresql: and exploiting PostgreSQL JDBC driver-specific parameters such as socketFactory and socketFactoryArg. This allows unauthenticated attackers to execute arbitrary code on the H2O-3 server with the privileges of the H2O-3 process. The issue is resolved in version 3.46.0.10.
VulDB
h2oai h2o-3 up to 3.46.0.9/3.46.0.10 REST API Endpoint /99/ImportSQLTable jdbc:postgresql code injection (EUVD-2026-25205)
vuldb·2026-04-23·CVSS 5.9
CVE-2026-3960 [MEDIUM] h2oai h2o-3 up to 3.46.0.9/3.46.0.10 REST API Endpoint /99/ImportSQLTable jdbc:postgresql code injection (EUVD-2026-25205)
A vulnerability classified as critical has been found in h2oai h2o-3 up to 3.46.0.9/3.46.0.10. Affected is the function jdbc:postgresql of the file /99/ImportSQLTable of the component REST API Endpoint. Performing a manipulation results in code injection.
This vulnerability is reported as CVE-2026-3960. The attack is possible to be carried out remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
H2O-3 is Vulnerable to Code Injection
ghsa·2026-04-23
CVE-2026-3960 [MEDIUM] CWE-94 H2O-3 is Vulnerable to Code Injection
H2O-3 is Vulnerable to Code Injection
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific dangerous parameters. An attacker can bypass these controls by switching the JDBC URL protocol to jdbc:postgresql: and exploiting PostgreSQL JDBC driver-specific parameters such as socketFactory and socketFactoryArg. This allows unauthenticated attackers to execute arbitrary code on the H2O-3 server with the privileges of the H2O-3 process. The issue is resolved in version 3.46.0.10.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-23
Published