CVE-2026-8750
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
In h2oai h2o-3 up to 7402, the importFiles function in PersistNFS.java (ImportFile API component) leads to information disclosure. The attack can be executed remotely, and a public exploit is available.
Risk Assessment
A remote attacker may access sensitive information, potentially leading to data leakage. The vendor did not respond to the disclosure, so a fix may not be available.
Recommendation
Restrict access to the ImportFile API, monitor for unusual requests, and consider compensating controls since no official fix is available.
Other vulnerabilities in h2o-3
See all- CVE-2026-3960Critical
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, allowing attackers to bypass these controls.
- CVE-2025-10768Medium
A vulnerability was found in h2oai h2o-3 up to version 3.46.08. The impacted element is an unknown function of the /99/ImportSQLTable file related to the IBMDB2 JDBC Driver component. Manipulation of the connection_url argument causes deserialization, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/PersistNFS.java of the component ImportFile API. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS