CVE-2026-8752: h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control
A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java of the component Rapids setproperty Primitive Handler. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
h2oai h2o-3 Rapids setproperty Primitivefrom your environment.If disabling is not possible, remove or uninstall the Rapids setproperty primitive/component or otherwise disable the Rapids feature that provides setproperty functionality until a vendor patch is available.
- Configuration
Disable the Rapids setproperty primitive (AstSetProperty.exec) or configure the application to refuse remote execution of setproperty operations until a vendor-supplied fix is available.
h2oai h2o-3 Rapids setproperty Primitive (AstSetProperty.exec) enabled = false - Compensating control
Restrict network access to h2o-3 instances to trusted IPs only (firewall/ACLs), place instances behind a WAF, and isolate affected services/networks to prevent remote exploitation of the vulnerable exec path.
- Operational
Monitor logs and telemetry for calls to AstSetProperty.exec or other suspicious setproperty activity, investigate any signs of exploitation, and rotate credentials or keys if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8752?
CVE-2026-8752 is classified as a medium severity vulnerability due to access control weaknesses.
How do I fix CVE-2026-8752?
To fix CVE-2026-8752, upgrade to version 7403 or later of the h2oai h2o-3 software.
What component is affected by CVE-2026-8752?
CVE-2026-8752 affects the exec function in the AstSetProperty.java file within the h2oai h2o-3 Rapids setproperty component.
What versions of h2oai h2o-3 are vulnerable to CVE-2026-8752?
Versions of h2oai h2o-3 up to and including 7402 are vulnerable to CVE-2026-8752.
What type of vulnerability is CVE-2026-8752?
CVE-2026-8752 is an access control vulnerability that could allow unauthorized execution of functions.