What’s Vulnerable › Vulnerabilities

CVE-2026-8750: h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-17 · updated 2026-10-14
• Weakness: CWE-200

Description

A vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/PersistNFS.java of the component ImportFile API. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• h2oai/h2o-3: through 7402

References

• https://vuldb.com/submit/810105
• https://vuldb.com/vuln/364377
• https://vuldb.com/vuln/364377/cti
• https://vulnplus-note.wetolink.com/share/wWjmsfKHRJi3

Get alerted when CVE-2026-8750 or the next vulnerability affects your stack