CVE-2026-8752

Vulnerability

Overview

CVE-2026-8752 describes a pre-authentication logic flaw in H2O-3 (up to version 7402) within the Rapids setproperty primitive handler, located in h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java. The setproperty primitive is intended for internal debugging use only, but the publicly exposed POST /99/Rapids endpoint allows unauthenticated remote callers to invoke it. This enables an attacker to write arbitrary system properties across all cluster nodes without any authentication [1].

Exploitation

Method

The attack exploits a bypass of the product's own security control. H2O-3 blocks POJO model import by default unless the system property sys.ai.h2o.pojo.import.enabled is explicitly set to true; when disabled, importing a POJO throws a SecurityException stating that POJO import is disabled due to security risk. An unauthenticated attacker can circumvent this protection in three steps: upload a malicious but valid POJO model source file, attempt the import (which correctly fails), then call POST /99/Rapids with ast=(setproperty 'sys.ai.h2o.pojo.import.enabled' 'true') to enable the disabled feature. Retrying the POJO import then succeeds [1].

Impact

Once the POJO is imported, it is compiled and instantiated on the server, and its constructor logic executes within the cluster. A proof-of-concept demonstrated that an attacker-controlled POJO can modify cluster-wide runtime state—for example, setting sys.ai.h2o.session.allow_properties=false, which changes the response of GET /3/InitID from session_properties_allowed=true to session_properties_allowed=false. This confirms that the attacker not only bypassed a default-disabled security gate but also achieved arbitrary code execution through the imported POJO and altered persistent cluster configuration [1].

Mitigation

Status

The vendor was contacted early about this disclosure but did not respond. At the time of publication, no official patch or advisory has been released for H2O-3. The exploit has been made publicly available, increasing the risk of active exploitation. Organizations running affected versions should consider network-level access controls to restrict exposure of the Rapids endpoint until a vendor-supplied fix becomes available.