---
id: "CVE-2024-45758"
kind: "vulnerability"
aliases: ["CVE-2024-45758", "GHSA-hrmc-jmp7-mpm2"]
title: "H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL"
severity: "critical"
cvss: 9.1
epss: 0.00906
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "ai.h2o:h2o-core", "fixed": [], "affected": "<= 3.46.0.7", "ecosystem": "maven"}, {"name": "h2o", "fixed": [], "affected": "<= 3.46.0.7", "ecosystem": "pypi"}, {"name": "h2o", "fixed": [], "affected": "<= 3.46.0.4", "ecosystem": "vendor"}]
ecosystems: ["maven", "pypi", "vendor"]
tags: ["ai-tooling", "cwe-502", "data-science", "h2o", "java", "python", "self-hosted"]
not_affected_if: ["auth-required", "no-untrusted-access"]
published_at: "2024-09-06T16:15:03+00:00"
first_seen_at: "2026-10-27T17:27:29+00:00"
updated_at: "2026-10-27T17:32:47+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-hrmc-jmp7-mpm2", "first_seen_at": "2026-10-27T17:27:29+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45758", "first_seen_at": "2026-10-27T17:32:47+00:00"}]
---

# H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

H2O.ai H2O lets an attacker set an arbitrary JDBC connection URL through the ImportSQLTable endpoint. A crafted URL such as one using queryInterceptors can trigger deserialization, file reads and command execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:ai.h2o:h2o-core affected <= 3.46.0.7 fixed ?
- pypi:h2o affected <= 3.46.0.7 fixed ?
- vendor:h2o affected <= 3.46.0.4 fixed ?

## How to check

- Check the installed version with `pip show h2o` or inspect the `ai.h2o:h2o-core` Maven dependency; versions through `3.46.0.4` are described as affected, and the advisory lists `3.46.0.7` as affected through the range.
- Confirm whether the H2O server exposes the ImportSQLTable REST endpoint to untrusted networks.

## Fix

- Upgrade `h2o` (PyPI) and `ai.h2o:h2o-core` (Maven) to a version newer than `3.46.0.7`; the fixed version is unknown from the sources.
- Restrict network access to the H2O API port until the upgrade is applied.

## Timeline

- 2026-10-27T17:27:29+00:00 ghsa https://github.com/advisories/GHSA-hrmc-jmp7-mpm2
- 2026-10-27T17:32:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-45758

## From the sources

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_