CVE-2025-10768

MediumCVSS 6.3

Published: 21/09/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

A vulnerability was found in h2oai h2o-3 up to version 3.46.08. The impacted element is an unknown function of the /99/ImportSQLTable file related to the IBMDB2 JDBC Driver component. Manipulation of the connection_url argument causes deserialization, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.

Risk Assessment

A remote attacker could exploit the deserialization vulnerability to perform unauthorized operations on the server, potentially leading to system compromise or data leakage. The vendor's lack of response means a patch may not be available.

Recommendation

Restrict access to the /99/ImportSQLTable endpoint and the IBMDB2 JDBC driver, and if possible, discontinue use of the vulnerable version until a fix is released. Monitor vendor communications and apply compensating controls (e.g., input validation, network segmentation).

Other vulnerabilities in h2o-3

CVE-2026-3960Critical
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, allowing attackers to bypass these controls.

Original NVD description (English source)

A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS