H2oai vulnerabilities
We track 24 vulnerabilities in H2oai products across 3 products. 24 are rated high or critical, and none are known to be exploited. The most recent was published on July 23, 2026.
Latest H2oai vulnerabilities
- 9.8 Critical severity
h2ogpt: Improper Limitation of a Pathname to a Restricted Directory
h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bea
- 9.8 Critical severity
A security flaw has been discovered in h2oai h2o-3 up to 7402.
A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserialization. The attack is possi
- 7.5 High severity
h2o-3: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/PersistNFS.java of the component ImportFile API. Such manipulation leads to information disclosure. Th
- 9.8 Critical severity
h2oai/h2o-3: Improper Control of Generation of Code
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which on
- 9.1 Critical severity
h2oai/h2o-3: External Control of File Name or Path
A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `/3/Parse` endpoint to inject attacker-controlled data as the header of an empty file, which is then e
- 9.8 Critical severity
h2o-3: Deserialization of Untrusted Data
A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connection_url leads to deserialization. The attack may be launched
- 9.8 Critical severity
h2o-3: Deserialization of Untrusted Data
A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be initi
- 9.8 Critical severity
h2oai/h2o-3: Deserialization of Untrusted Data
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by b
- 9.8 Critical severity
h2oai/h2o-3: Deserialization of Untrusted Data
A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Val
- 9.8 Critical severity
h2oai/h2o-3: Deserialization of Untrusted Data
A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution and reading of system files. This issue affects the latest master branch version 3.47.0.99999. The vuln
- 8.2 High severity
h2oai/h2o-3: External Control of File Name or Path
In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` pa
- 7.5 High severity
h2oai/h2o-3: Synchronous Access of Remote Resource without Timeout
A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending mu
- 7.5 High severity
h2oai/h2o-3: Allocation of Resources Without Limits or Throttling
A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeat
- 7.5 High severity
h2oai/h2o-3: Improper Handling of Highly Compressed Data (Data Amplification)
In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This is
- 7.1 High severity
h2oai/h2o-3: Absolute Path Traversal
In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite
- 7.5 High severity
h2oai/h2o-3: Improper Control of Generation of Code
In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large files to arbitrary di
- 9.8 Critical severity
h2oai/h2o-3: Deserialization of Untrusted Data
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable
- 7.5 High severity
h2oai/h2o-3: Inefficient Regular Expression Complexity
A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause i
- 7.5 High severity
h2oai/h2o-3: Inefficient Regular Expression Complexity
A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By send
- 9.8 Critical severity
h2o-3: Deserialization of Untrusted Data
A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads
- 9.1 Critical severity
h2o-3: Deserialization of Untrusted Data
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document conta
- 7.5 High severity
h2oai/h2o-3: Improper Control of Generation of Code
In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument,
- 7.1 High severity
An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository.
An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.
- 7.5 High severity
h2oai/h2o-3: Missing Authorization
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation an