CVE-2026-8752 Details

A critical pre-authentication logic flaw exists in H2O-3 versions prior to 7402. The vulnerability is in the Rapids setproperty primitive handler, specifically within the exec function of AstSetProperty.java. This flaw allows unauthenticated users to manipulate system properties across all cluster nodes via the POST /99/Rapids endpoint. The issue arises because the application exposes an internal debugging primitive that can bypass default security measures, particularly those related to importing Java POJOs, which is disabled by default due to associated security risks. Exploitation of this vulnerability can lead to unauthorized execution of Java code on the server, manipulation of runtime security properties, and potential cluster-wide abuse.

Remove or restrict public access to debugging primitives like setproperty through the POST /99/Rapids endpoint. Ensure that unauthenticated or low-privilege users cannot modify security-related properties. Make high-risk security switches immutable at runtime or configurable only at startup by administrators. Add authentication and authorization checks to the POJO import process, and require trusted signatures or prebuilt artifacts instead of allowing arbitrary Java source code to be uploaded and executed.