CVE-2026-3960

🗓️ 23 Apr 2026 08:47:48Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 9 Views🌐 WEB

Critical RCE in H2O-3 via REST /99/ImportSQLTable; PostgreSQL params bypassed; fixed 3.46.0.10.

Reporter	Title	Published	Views	Family All 14
Huntr	H2O-3 PostgreSQL Driver RCE - Bypassing CVE-2025-6544 Mitigation	16 Jan 202608:47	–	huntr
ATTACKERKB	CVE-2026-3960	23 Apr 202608:47	–	attackerkb
CNNVD	H2O 代码注入漏洞	23 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-3960 Remote Code Execution in h2oai/h2o-3	23 Apr 202608:47	–	cvelist
EUVD	EUVD-2026-25205	23 Apr 202612:31	–	euvd
Github Security Blog	H2O-3 is Vulnerable to Code Injection	23 Apr 202612:31	–	github
GitLab Advisory Database	H2O-3 is Vulnerable to Code Injection	23 Apr 202600:00	–	gitlab
NVD	CVE-2026-3960	23 Apr 202610:16	–	nvd
OSV	GHSA-QMCV-HH7C-3M56 H2O-3 is Vulnerable to Code Injection	23 Apr 202612:31	–	osv
Positive Technologies	PT-2026-34648	23 Apr 202600:00	–	ptsecurity

NVD

Vulners

Node

h2o h2oRange<3.46.0.10

[
  {
    "vendor": "h2oai",
    "product": "h2oai/h2o-3",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "3.46.0.10",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/h2oai/h2o-3/commit/b9ae2d3c5220db2dc53753357a783e590364d044
huntr	www.huntr.com/bounties/6954fe04-b905-453f-8c53-205ac8377e0d

Parameter	Position	Path	Description	CWE
socketFactory	request body	99/ImportSQLTable	Unauthenticated RCE via improper blacklist for JDBC URLs in ImportSQLTable endpoint	CWE-94
socketFactoryArg	request body	99/ImportSQLTable	Unauthenticated RCE via improper blacklist for JDBC URLs in ImportSQLTable endpoint	CWE-94

19 May 2026 21:52Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19.8

CVSS 35.9

EPSS0.00258

SSVC

CWE-94