PT-2026-34648 · H2O-3 · H2O-3

Published 2026-04-23 · Updated 2026-05-19 · CVE-2026-3960

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions H2O-3 versions prior to 3.46.0.10

Description An unauthenticated remote code execution issue exists in the REST API endpoint '/99/ImportSQLTable'. The flaw is caused by insufficient security controls in the parameter blacklist mechanism, which only filters dangerous parameters specific to the MySQL JDBC driver. An attacker can bypass these restrictions by changing the JDBC URL protocol to 'jdbc:postgresql:' and utilizing PostgreSQL JDBC driver-specific parameters, such as socketFactory and socketFactoryArg, to execute arbitrary code on the server with the privileges of the H2O-3 process.

Recommendations Update to version 3.46.0.10.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-3960

GHSA-QMCV-HH7C-3M56

Affected Products

H2O-3

References · 7

• 🔥 https://huntr.com/bounties/6954fe04-b905-453f-8c53-205ac8377e0d · Exploit
• https://github.com/h2oai/h2o-3/commit/b9ae2d3c5220db2dc53753357a783e590364d044 · Patch
• https://osv.dev/vulnerability/GHSA-qmcv-hh7c-3m56 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3960 · Security Note
• https://github.com/h2oai/h2o-3 · Note
• https://twitter.com/CVEnew/status/2047359867472470173 · Twitter Post
• https://t.me/cveNotify/164119 · Telegram Post