CVE-2026-8751 Details

A critical pre-authentication vulnerability allowing insecure deserialization has been identified in H2O.ai H2O-3 versions prior to 7402. This issue arises in the JAR Handler component, specifically within the 'importBinaryModel' function of 'Model.java'. The vulnerability can be exploited remotely by uploading a malicious JAR file that is then executed on the server during model scoring. The deserialization flaw was confirmed through a proof-of-concept that demonstrated the execution of attacker-controlled code via a restored reference to a custom metric function.

To address this vulnerability, it is recommended to require authentication and strong authorization for high-risk endpoints related to model import, export, and scoring. Additionally, untrusted model files should not be deserialized using generic methods. Instead, a safe format should be used that excludes executable references. After deserialization, all imported model parameters should be revalidated and any dynamic class-loading references rejected. Consider disabling user-provided code loading from DKV by default, unless needed in trusted environments.