CVE-2026-8751: H2o H2o RCE Vulnerability

CVE-2026-8751 Overview

CVE-2026-8751 is an insecure deserialization vulnerability in h2oai h2o-3 versions up to 7402. The flaw resides in the importBinaryModel function of h2o-core/src/main/java/hex/Model.java within the JAR Handler component. An attacker can manipulate input to trigger unsafe deserialization remotely without authentication. According to the VulDB report, the exploit has been released publicly, and the vendor did not respond to disclosure attempts. The vulnerability is tracked under CWE-20: Improper Input Validation.

Critical Impact

Remote, unauthenticated attackers can exploit unsafe deserialization in importBinaryModel to influence the integrity, confidentiality, and availability of the h2o-3 machine learning platform.

Affected Products

• h2oai h2o-3 versions up to and including 7402
• h2o-core component containing hex/Model.java
• JAR Handler subcomponent processing imported binary models

Discovery Timeline

• 2026-05-17 - CVE-2026-8751 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-8751

Vulnerability Analysis

The vulnerability exists in the importBinaryModel function within h2o-core/src/main/java/hex/Model.java. This function processes binary model artifacts supplied to the h2o-3 platform. The JAR Handler component performs deserialization on attacker-controlled data without sufficient validation. Because h2o-3 commonly exposes a network-accessible REST interface for model management, an attacker can reach the vulnerable code path remotely. The disclosure indicates a public exploit exists, increasing the likelihood of opportunistic attacks against exposed instances.

Root Cause

The root cause is improper input validation [CWE-20] during binary model import. The importBinaryModel function reconstructs Java objects from a serialized stream without enforcing class allow-lists or integrity checks. Java deserialization of untrusted data allows gadget chains in the classpath to execute logic during object reconstruction. The JAR Handler context expands the attack surface by loading classes from the imported archive.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a crafted binary model to the importBinaryModel endpoint exposed by the h2o-3 server. During deserialization, malicious object graphs are reconstructed, leading to manipulation of application state. Because h2o-3 is frequently deployed in data science environments with access to sensitive datasets, successful exploitation can disclose training data or tamper with model behavior.

No verified public proof-of-concept code is included in this advisory. Refer to the VulDB Vulnerability Details #364378 and VulDB CTI Analysis reports for additional technical context.

Detection Methods for CVE-2026-8751

Indicators of Compromise

• Unexpected HTTP requests to the h2o-3 REST endpoint responsible for importing binary models, particularly from external sources.
• Unusual Java process activity originating from the h2o-3 service, including spawning of shells or network connections to unknown hosts.
• Newly created or modified JAR files in the h2o-3 working directory outside of scheduled deployments.

Detection Strategies

• Inspect application logs for invocations of importBinaryModel with suspicious payload sizes or unauthenticated callers.
• Monitor Java Virtual Machine telemetry for deserialization of unexpected classes, especially common gadget chain classes such as those from Commons Collections or Spring.
• Apply network detection rules to identify POST requests carrying serialized Java objects (magic bytes AC ED 00 05) to h2o-3 service ports.

Monitoring Recommendations

• Forward h2o-3 access logs and host process telemetry to a centralized analytics platform for correlation against threat intelligence feeds.
• Baseline normal model import activity and alert on deviations in source IP, frequency, and payload characteristics.
• Track child processes of the h2o-3 JVM to identify post-exploitation behavior such as bash, cmd.exe, or outbound connections.

How to Mitigate CVE-2026-8751

Immediate Actions Required

• Restrict network access to h2o-3 instances by placing them behind authenticated reverse proxies or VPNs, and block internet exposure.
• Disable or firewall the model import endpoint when it is not required for production workflows.
• Audit existing h2o-3 deployments for unauthorized model imports and unexpected process activity since the publication date.

Patch Information

No vendor advisory or fixed version is referenced in the available CVE data. The disclosure notes that the vendor was contacted but did not respond. Track upstream updates at the h2oai project repository and the VulDB Vulnerability Details #364378 for any future remediation guidance.

Workarounds

• Run h2o-3 as a low-privilege service account with restricted file system and network permissions to limit deserialization impact.
• Import only binary models from trusted, internally signed sources and validate cryptographic signatures before passing data to importBinaryModel.
• Deploy a Java security manager or runtime deserialization filter (jdk.serialFilter) to restrict allowed classes during object reconstruction.

# Example: restrict Java deserialization classes via JVM flag
java -Djdk.serialFilter='hex.**;water.**;!*' -jar h2o.jar