{"id":"CVE-2024-10553","kind":"vulnerability","aliases":["CVE-2024-10553","GHSA-h7xg-cmpp-48hf"],"related":[],"title":"H2O Deserialization of Untrusted Data Vulnerability","description":"A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.46.0.6.","summary":"The H2O machine learning REST API accepts user-controlled JDBC URLs on two endpoints and passes them to DriverManager.getConnection, which deserializes untrusted data when a MySQL or PostgreSQL driver is on the classpath. An unauthenticated remote attacker can execute arbitrary code on the server.","severity":"critical","cvss":9.8,"epss":0.01587,"exploited":false,"exploited_at":null,"products":[{"name":"h2o","fixed":["3.46.0.6"],"affected":"< 3.46.0.6","ecosystem":"pypi"},{"name":"ai.h2o:h2o-core","fixed":["3.46.0.6"],"affected":"< 3.46.0.6","ecosystem":"maven"},{"name":"h2o","fixed":[],"affected":"= 3.46.0.4","ecosystem":"vendor"}],"ecosystems":["maven","pypi","vendor"],"tags":["cwe-502","h2o","java","ml-pipelines","package","python","self-hosted"],"not_affected_if":["already-on-3.46.0.6","no-mysql-or-postgresql-driver","rest-api-not-exposed"],"how_to_check":"- Check the installed H2O Python package version with `pip show h2o` and compare against `3.46.0.6`\n- Check the Maven dependency `ai.h2o:h2o-core` in the project's build file or `mvn dependency:tree` and compare against `3.46.0.6`\n- Check whether the H2O REST API is reachable from untrusted networks, since the endpoints `POST /99/ImportSQLTable` and `POST /3/SaveToHiveTable` are the attack path","fix":"- Upgrade the `h2o` PyPI package to `3.46.0.6` or later\n- Upgrade the `ai.h2o:h2o-core` Maven artifact to `3.46.0.6` or later\n- Restrict network access to the H2O REST API to trusted hosts until upgraded","status":"open","published_at":"2025-03-20T10:15:17+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","triaged_at":"2026-10-27T16:37:59+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-27T16:37:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `h2o` PyPI package to `3.46.0.6` or later\n- Upgrade the `ai.h2o:h2o-core` Maven artifact to `3.46.0.6` or later\n- Restrict network access to the H2O REST API to trusted hosts until upgraded","reach":"network","title":"H2O: unauthenticated JDBC URL deserialization in REST API allows code execution","impact":"high","summary":"The H2O machine learning REST API accepts user-controlled JDBC URLs on two endpoints and passes them to DriverManager.getConnection, which deserializes untrusted data when a MySQL or PostgreSQL driver is on the classpath. An unauthenticated remote attacker can execute arbitrary code on the server.","category":"package","nicknames":[],"who_cares":["h2o","python","java","self-hosted","ml-pipelines"],"confidence":0.85,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the H2O server unauthenticated","analyst_note":"","how_to_check":"- Check the installed H2O Python package version with `pip show h2o` and compare against `3.46.0.6`\n- Check the Maven dependency `ai.h2o:h2o-core` in the project's build file or `mvn dependency:tree` and compare against `3.46.0.6`\n- Check whether the H2O REST API is reachable from untrusted networks, since the endpoints `POST /99/ImportSQLTable` and `POST /3/SaveToHiveTable` are the attack path","needs_analyst":false,"not_affected_if":["already-on-3.46.0.6","rest-api-not-exposed","no-mysql-or-postgresql-driver"],"who_is_affected":"Teams running the H2O-3 server or the H2O Python or Java packages below 3.46.0.6 that expose the REST API to a network the attacker can reach. Exposure depends on the MySQL or PostgreSQL JDBC driver being on the classpath, which the sources describe as the condition for deserialization.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000717,"input_tokens":3489,"output_tokens":736,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-10553':9A,17A '-2024':8A,16A '-502':25B '/3/savetohivetable':113C '/99/importsqltable':110C '3.46.0.4':89C '3.46.0.6':144C '48hf':14A 'accept':42B 'ai.h2o':19A 'allow':90C 'api':41B,87C 'arbitrari':76B,96C 'attack':73B,93C 'avail':134C 'classpath':69B,137C 'cmpp':13A 'code':77B,97C 'control':45B,117C 'core':22A 'cve':7A,15A 'cwe':24B 'data':5A,59B,102C 'deseri':2A,57B,99C,126C 'driver':65B,132C 'drivermanager.getconnection':55B,123C 'endpoint':50B,108C 'execut':75B,95C 'exist':105C 'fix':141C 'ghsa':11A 'ghsa-h7xg-cmpp-48hf':10A 'h2o':1A,18A,21A,23A,26B,37B 'h2o-core':20A 'h2oai/h2o-3':85C 'h7xg':12A 'host':35B 'issu':139C 'java':27B 'jdbc':46B,118C 'lead':124C 'learn':39B 'machin':38B 'ml':29B 'ml-pipelin':28B 'mysql':62B,129C 'packag':31B 'pass':52B,121C 'pipelin':30B 'post':109C,112C 'postgresql':64B,131C 'python':32B 'remot':72B,92C 'rest':40B,86C 'self':34B 'self-host':33B 'server':80B 'two':49B 'unauthent':71B,91C 'untrust':4A,58B,101C 'url':47B,119C 'user':44B,116C 'user-control':43B,115C 'version':88C,143C 'via':98C 'vulner':6A,82C,104C","nicknames":[],"mitigations":[],"who_affected":"Teams running the H2O-3 server or the H2O Python or Java packages below 3.46.0.6 that expose the REST API to a network the attacker can reach. Exposure depends on the MySQL or PostgreSQL JDBC driver being on the classpath, which the sources describe as the condition for deserialization.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:17+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h7xg-cmpp-48hf","url":"https://github.com/advisories/GHSA-h7xg-cmpp-48hf","severity":"critical","published_at":"2025-03-20T12:32:39+00:00","modified_at":"2026-10-27T16:33:53+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","fetched_at":"2026-10-27T16:35:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-10553","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10553","severity":null,"published_at":"2025-03-20T10:15:17+00:00","modified_at":"2026-06-17T06:55:55+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}