Introduction
Remote attackers can execute arbitrary code on H2O-3 clusters by exploiting a critical deserialization flaw in the REST API. Any organization that uses H2O-3 for machine learning workflows and exposes the ImportSQLTable endpoint is at risk until it patches.
About H2O.ai and H2O-3: H2O.ai is a prominent vendor of open-source and enterprise AI/ML platforms. H2O-3, its widely used distributed machine learning platform, is deployed in financial services, healthcare, and many Fortune 500 companies. The platform's REST API connects it to a range of data sources and automation pipelines, so the security of that API matters to the wider AI/ML ecosystem.
Technical Information
CVE-2025-5662 is a deserialization vulnerability in the H2O-3 REST API endpoint POST /99/ImportSQLTable. The endpoint imports SQL table data into H2O-3 clusters using JDBC connection parameters that the user supplies. In all versions up to 3.46.0.7, H2O-3 does not properly validate or sanitize these JDBC parameters when they arrive in key-value format.
The application passes user-controlled JDBC parameters directly to Java deserialization routines. An attacker can craft a malicious JDBC URL that carries a serialized Java object (a gadget chain). When the vulnerable endpoint deserializes that object, it runs arbitrary code inside the H2O-3 process. The attack needs no authentication and can be carried out remotely over the network.
The issue is most relevant when H2O-3 runs with MySQL JDBC Driver version 8.0.19 and JDK version 8u112, because those versions make the exploitation path easier. The unsafe deserialization pattern underneath it may also be present with other JDBC drivers or Java versions.
Previously reported H2O-3 issues, including CVE-2025-6507 and CVE-2024-10553, are closely related: they also involve REST API endpoints that process untrusted serialized data. In every case the root cause is insufficient input validation combined with unsafe Java deserialization of user-supplied input.
Affected Systems and Versions
- H2O-3 machine learning platform
- All versions up to and including 3.46.0.7
- Vulnerable when using MySQL JDBC Driver 8.0.19 and JDK 8u112
- Vulnerable endpoint: POST /99/ImportSQLTable REST API
- Fixed in version 3.46.0.8
Vendor Security History
H2O.ai has fixed several deserialization vulnerabilities in H2O-3 in recent years, including these two:
- CVE-2025-6507: Critical RCE in JDBC connection handling, patched in 3.46.0.8 (source)
- CVE-2024-10553: Deserialization flaw in ImportSQLTable and SaveToHiveTable endpoints (source)
H2O.ai usually issues patches promptly after disclosure. The same kind of flaw keeps recurring, though, which points to an unresolved architectural problem with input validation and deserialization safety.
