← Vulnerability feed

Vulnerability record · CVE-2026-8752 · published 17 May 2026

CVE-2026-8752: H2o improper access control vulnerability

H2o · H2o

A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java of the component Rapids setproperty Primitive Handler. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

5.5 CVSS 4.0 Medium EPSS 0.54% · top 56.2% CWE-266 · CWE-266CWE-284 · Improper access control
5.5CVSS 4.0 base score, v2 5.0
0.54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java of the component Rapids setproperty Primitive Handler. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://vuldb.com/submit/810108 Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/364379 Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/364379/cti Permissions RequiredVDB Entry
https://vulnplus-note.wetolink.com/share/pyVa0GWPuAZE Broken Link

Track CVE-2026-8752 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-3960H2o code injection vulnerabilityA critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior…EPSS 1.0%9.8CVE-2025-6544H2o deserialization of untrusted data vulnerabilityA deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary c…EPSS 0.92%9.8CVE-2024-10553H2o deserialization of untrusted data vulnerabilityA vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization o…EPSS 1.6%9.8CVE-2023-6016H2o code injection vulnerabilityAn attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.EPSS 31%9.1CVE-2024-45758H2o deserialization of untrusted data vulnerabilityH2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. …EPSS 0.91%8.2CVE-2024-8616H2o vulnerabilityIn h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability aris…EPSS 0.55%8.2CVE-2023-6569H2o vulnerabilityExternal Control of File Name or Path in h2oai/h2o-3EPSS 0.72%7.5CVE-2026-54340H2o uncontrolled resource consumption vulnerabilityh2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combin…EPSS 0.49%

Source: NIST National Vulnerability Database (record CVE-2026-8752), CISA KEV, FIRST EPSS (scores of 2026-10-07). This page is refreshed as NVD updates the record.