CVE-2026-3960

The security mechanism in H2O-3 applies a blacklist of dangerous JDBC parameters, however it is only directed against the MySQL driver. An attacker can bypass this control by changing the JDBC URL protocol from jdbc:mysql: to jdbc:postgresql:, and then exploiting parameters specific to the PostgreSQL JDBC driver, such as socketFactory and socketFactoryArg. The /99/ImportSQLTable endpoint does not require authentication, which means the exploit is available to anyone who can connect to the server. As a result, it is possible to load and execute arbitrary code in the context of the H2O-3 process.

An unauthenticated attacker can execute arbitrary code on the H2O-3 server with the privileges of the H2O-3 process, which may lead to complete server compromise, data theft, and further lateral movement in the network.

H2O-3 should be updated to version 3.46.0.10, in which the issue has been resolved. If immediate update is not possible, it is recommended to restrict network access to the /99/ImportSQLTable endpoint using a firewall or network rules so that it is accessible only from trusted IP addresses.

H2O-3 version 3.46.0.9 and all earlier versions