{"id":"CVE-2024-5986","kind":"vulnerability","aliases":["CVE-2024-5986","GHSA-wj3h-wx8g-x699"],"related":[],"title":"H2O has an External Control of File Name or Path vulnerability","description":"A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `/3/Parse` endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the `/3/Frames/framename/export` endpoint. The impact of this vulnerability includes the potential for remote code execution and complete access to the system running h2o-3, as attackers can overwrite critical files such as private SSH keys or script files.","summary":"H2O-3 machine learning server lets remote users write arbitrary data to any file on the host through the /3/Parse and /3/Frames export endpoints. An attacker can overwrite files such as SSH keys or scripts, which can lead to remote code execution and full system takeover.","severity":"critical","cvss":9.1,"epss":0.00714,"exploited":false,"exploited_at":null,"products":[{"name":"ai.h2o:h2o-core","fixed":[],"affected":"<= 3.46.0.1","ecosystem":"maven"},{"name":"h2o","fixed":[],"affected":"<= 3.46.0.1","ecosystem":"pypi"}],"ecosystems":["maven","pypi"],"tags":["ai-tooling","cwe-73","h2o","java","machine-learning","python","self-hosted"],"not_affected_if":["local-only-use","network-isolated"],"how_to_check":"- Check the installed h2o version with `pip show h2o` or the Maven `ai.h2o:h2o-core` version; affected versions are `3.46.0.1` and below.\n- Check whether the H2O server is reachable from untrusted networks and whether `/3/Parse` and `/3/Frames` are exposed.","fix":"- Upgrade the `h2o` PyPI package and `ai.h2o:h2o-core` Maven artifact to a fixed release; the fixed version is unknown from the sources.\n- Until patched, restrict network access to the H2O server so it is not reachable from untrusted clients.","status":"open","published_at":"2026-02-02T11:16:16+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","triaged_at":"2026-10-27T16:38:04+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-27T16:38:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `h2o` PyPI package and `ai.h2o:h2o-core` Maven artifact to a fixed release; the fixed version is unknown from the sources.\n- Until patched, restrict network access to the H2O server so it is not reachable from untrusted clients.","reach":"network","title":"H2O-3: remote attacker writes arbitrary files, leading to code execution","impact":"high","summary":"H2O-3 machine learning server lets remote users write arbitrary data to any file on the host through the /3/Parse and /3/Frames export endpoints. An attacker can overwrite files such as SSH keys or scripts, which can lead to remote code execution and full system takeover.","category":"ai-tooling","nicknames":[],"who_cares":["h2o","python","java","machine-learning","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker overwrites SSH keys or scripts, gaining remote code execution","analyst_note":"Confirm the fixed version and whether authentication gates /3/Parse; see https://github.com/advisories/GHSA-wj3h-wx8g-x699.","how_to_check":"- Check the installed h2o version with `pip show h2o` or the Maven `ai.h2o:h2o-core` version; affected versions are `3.46.0.1` and below.\n- Check whether the H2O server is reachable from untrusted networks and whether `/3/Parse` and `/3/Frames` are exposed.","needs_analyst":true,"not_affected_if":["local-only-use","network-isolated"],"who_is_affected":"Teams running H2O-3 (h2o-core or the Python h2o package) as a server that accepts requests over a network. Exposure depends on whether the /3/Parse and /3/Frames endpoints are reachable by untrusted clients; the sources do not say whether authentication is required. Teams only using H2O locally in a notebook on a trusted machine are at much lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.0007,"input_tokens":3465,"output_tokens":708,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':13A,21A '-3':43B,156C '-5986':14A,22A '-73':32B '/3/frames':63B '/3/frames/framename/export':134C '/3/parse':61B,113C '3.46.0.1':93C 'access':150C 'achiev':109C 'ai':29B 'ai-tool':28B 'ai.h2o':23A 'allow':94C 'arbitrari':51B,99C 'attack':67B,96C,118C,158C 'attacker-control':117C 'code':82B,146C 'complet':149C 'control':5A,119C 'core':26A 'critic':161C 'cve':12A,20A 'cwe':31B 'data':52B,100C,120C 'empti':126C 'endpoint':65B,114C,135C 'execut':83B,147C 'exploit':111C 'export':64B,131C 'extern':4A 'file':7A,55B,70B,103C,127C,162C,170C 'full':85B 'ghsa':16A 'ghsa-wj3h-wx8g-x699':15A 'h2o':1A,25A,27A,33B,42B,155C 'h2o-core':24A 'h2oai/h2o-3':91C 'header':123C 'host':41B,58B 'impact':137C 'includ':141C 'inject':116C 'java':34B 'key':74B,167C 'lead':79B 'learn':37B,45B 'let':47B 'machin':36B,44B 'machine-learn':35B 'name':8A 'overwrit':69B,160C 'path':10A 'potenti':143C 'privat':165C 'python':38B 'remot':48B,81B,95C,145C 'run':154C 'script':76B,169C 'self':40B 'self-host':39B 'server':46B,106C 'ssh':73B,166C 'system':86B,153C 'takeov':87B 'tool':30B 'use':132C 'user':49B 'version':92C 'vulner':11A,89C,140C 'wj3h':17A 'write':50B,98C 'wx8g':18A 'x699':19A","nicknames":[],"mitigations":[],"who_affected":"Teams running H2O-3 (h2o-core or the Python h2o package) as a server that accepts requests over a network. Exposure depends on whether the /3/Parse and /3/Frames endpoints are reachable by untrusted clients; the sources do not say whether authentication is required. Teams only using H2O locally in a notebook on a trusted machine are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-02-02T11:16:16+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-wj3h-wx8g-x699","url":"https://github.com/advisories/GHSA-wj3h-wx8g-x699","severity":"critical","published_at":"2026-02-02T12:31:14+00:00","modified_at":"2026-10-27T16:30:55+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","fetched_at":"2026-10-27T16:35:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-5986","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5986","severity":null,"published_at":"2026-02-02T11:16:16+00:00","modified_at":"2026-06-17T08:17:02+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}