h2oai vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-65700 h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, andCritical 9.3 · Jul 23, 2026
• CVE-2026-3960 A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior.Critical 9.8 · Apr 23, 2026
• CVE-2024-5986 A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server.Critical 9.1 · Feb 2, 2026
• CVE-2025-6544 A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code.Critical 9.8 · Sep 21, 2025
• CVE-2025-5662 A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7.Critical 9.8 · Sep 2, 2025
• CVE-2025-6507 A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution andCritical 9.8 · Sep 1, 2025
• CVE-2024-8616 In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server.High 8.2 · Mar 20, 2025
• CVE-2024-8062 A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service.High 7.5 · Mar 20, 2025
• CVE-2024-7768 A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service.High 7.5 · Mar 20, 2025
• CVE-2024-7765 In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service.High 7.5 · Mar 20, 2025
• CVE-2024-6854 In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in thHigh 7.1 · Mar 20, 2025
• CVE-2024-10572 In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser.High 7.5 · Mar 20, 2025
• CVE-2024-10553 A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrustedCritical 9.8 · Mar 20, 2025
• CVE-2024-10550 A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack.High 7.5 · Mar 20, 2025
• CVE-2024-10549 A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack.High 7.5 · Mar 20, 2025
• CVE-2024-45758 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution.Critical 9.1 · Sep 6, 2024
• CVE-2024-5979 In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be High 7.5 · Jun 27, 2024
• CVE-2024-1456 An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository.High 7.1 · Apr 15, 2024
• CVE-2023-6569 External Control of File Name or Path in h2oai/h2o-3High 8.2 · Dec 14, 2023
• CVE-2023-6038 A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with thHigh 7.5 · Nov 16, 2023
• CVE-2023-6017 H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.High 7.1 · Nov 16, 2023
• CVE-2023-6016 An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.Critical 9.8 · Nov 16, 2023