CVE-2026-8750: h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure
A vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/PersistNFS.java of the component ImportFile API. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
h2oai/h2o-3from your environment.Uninstall h2oai h2o-3 (affected versions up to 7402) if the component is not required.
- Compensating control
Block or restrict network access to the ImportFile API (PersistNFS.importFiles). If possible disable the PersistNFS importFiles functionality, restrict access to trusted IP ranges, and apply WAF/firewall rules to prevent remote exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8750?
CVE-2026-8750 is classified as a information disclosure vulnerability.
How do I fix CVE-2026-8750?
To mitigate CVE-2026-8750, update to a version of H2O.ai h2o-3 that is newer than 7402.
What components are affected by CVE-2026-8750?
CVE-2026-8750 affects the ImportFile API in the PersistNFS.java component of H2O.ai h2o-3.
Which versions of H2O.ai h2o-3 are impacted by CVE-2026-8750?
Versions of H2O.ai h2o-3 up to and including 7402 are affected by CVE-2026-8750.
What kind of information does CVE-2026-8750 disclose?
CVE-2026-8750 can potentially expose sensitive information through improper handling in the importFiles function.