CVE-2026-65700: H2O unauth path traversal

CISO Take

h2oGPT's OpenAI-compatible files API fails to authenticate requests because its default API key is empty, and the get_user_dir function builds filesystem paths directly from the unsanitized bearer token — meaning any network client can supply traversal sequences to read, write, or delete arbitrary files on the host, including startup hooks, which converts the flaw into unauthenticated remote code execution (CVSS 9.8, no privileges or user interaction needed). With 26 downstream dependents and 14 other CVEs already recorded against this package, the blast radius is significant for anyone self-hosting h2oGPT as an internal or customer-facing GenAI service; there is no EPSS score or CISA KEV listing yet and no public Nuclei template, but a technical writeup with exploit details is already public, so the window before mass scanning starts is likely short. No patched version has been published as of this writing, so treat every internet-reachable h2oGPT deployment as compromised-by-default: take the files API offline or firewall it, set a strong non-empty API key rather than relying on the application's default, and monitor for path-traversal sequences in Authorization headers and unexpected writes to startup hook files.

Sources: NVD VulnCheck OpenSSF ATLAS

What is the risk?

Critical risk. Exploitability is trivial — no authentication, no user interaction, and no AI/ML-specific knowledge required, just a crafted bearer token string containing traversal sequences (CWE-22). Impact is maximal: arbitrary file read/write/delete on the host, directly usable for full remote code execution via startup hooks or application-loaded files (confidentiality, integrity, and availability all rated High in the CVSS vector). Exposure is network-wide since the vulnerable component is an OpenAI-compatible API endpoint typically deployed for external or internal LLM consumption; the fact that authentication is bypassed by the application's default configuration means most unpatched deployments are exploitable out of the box, not just misconfigured ones. Absence from CISA KEV and lack of an EPSS score reflect the CVE's recency (published 2026-07-23) rather than low risk — a public technical writeup already exists and OpenSSF Scorecard for the package is a middling 5.9/10.

How does the attack unfold?

Discovery

Attacker identifies an internet-facing h2oGPT deployment exposing the OpenAI-compatible files API with no meaningful authentication configured.

AML.T0049

Exploitation

Attacker sends a request to the file content/upload/delete endpoint using a bearer token crafted with path traversal sequences, bypassing the empty-by-default API key check.

AML.T0096

Persistence

Attacker writes malicious content to a startup hook or application-loaded file reachable via the traversal, planting code that will execute on next load.

Impact

The planted code executes with server-process privileges when h2oGPT restarts or reloads the file, giving the attacker full remote code execution on the host.

Discovery

Attacker identifies an internet-facing h2oGPT deployment exposing the OpenAI-compatible files API with no meaningful authentication configured.

AML.T0049

Exploitation

Attacker sends a request to the file content/upload/delete endpoint using a bearer token crafted with path traversal sequences, bypassing the empty-by-default API key check.

AML.T0096

Persistence

Attacker writes malicious content to a startup hook or application-loaded file reachable via the traversal, planting code that will execute on next load.

Impact

The planted code executes with server-process privileges when h2oGPT restarts or reloads the file, giving the attacker full remote code execution on the host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
H2O	pip	—	No patch
7.5K OpenSSF 5.5 27 dependents Pushed 11d ago 4% patched ~0d to patch Full package profile →

Do you use H2O? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

1.5%

chance of exploitation in 30 days

Higher than 73% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

No patched version is currently published, so prioritize compensating controls: (1) never rely on h2oGPT's default empty API key — configure a strong, unpredictable, non-empty key for the OpenAI-compatible endpoint immediately; (2) remove direct internet exposure of the files content/upload/delete endpoints, placing them behind a VPN, reverse proxy with independent authentication, or IP allowlist; (3) run the h2oGPT process with least-privilege filesystem permissions and container/chroot isolation so a successful traversal cannot reach startup hooks or sensitive host paths; (4) monitor logs and WAF rules for traversal sequences (../, URL-encoded variants) in Authorization/Bearer headers and for unexpected file writes outside the configured user directory; (5) track the h2oGPT GitHub repo and the VulnCheck advisory for an official fix and apply it as soon as released.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution API Inference AML.T0049 - Exploit Public-Facing Application AML.T0096 - AI Service API

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.8.6 - AI system operation and monitoring

NIST AI RMF

MANAGE-2.3 - Response and recovery for previously unknown AI system risks

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-65700?

h2oGPT's OpenAI-compatible files API fails to authenticate requests because its default API key is empty, and the get_user_dir function builds filesystem paths directly from the unsanitized bearer token — meaning any network client can supply traversal sequences to read, write, or delete arbitrary files on the host, including startup hooks, which converts the flaw into unauthenticated remote code execution (CVSS 9.8, no privileges or user interaction needed). With 26 downstream dependents and 14 other CVEs already recorded against this package, the blast radius is significant for anyone self-hosting h2oGPT as an internal or customer-facing GenAI service; there is no EPSS score or CISA KEV listing yet and no public Nuclei template, but a technical writeup with exploit details is already public, so the window before mass scanning starts is likely short. No patched version has been published as of this writing, so treat every internet-reachable h2oGPT deployment as compromised-by-default: take the files API offline or firewall it, set a strong non-empty API key rather than relying on the application's default, and monitor for path-traversal sequences in Authorization headers and unexpected writes to startup hook files.

Is CVE-2026-65700 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-65700, increasing the risk of exploitation.

How to fix CVE-2026-65700?

No patched version is currently published, so prioritize compensating controls: (1) never rely on h2oGPT's default empty API key — configure a strong, unpredictable, non-empty key for the OpenAI-compatible endpoint immediately; (2) remove direct internet exposure of the files content/upload/delete endpoints, placing them behind a VPN, reverse proxy with independent authentication, or IP allowlist; (3) run the h2oGPT process with least-privilege filesystem permissions and container/chroot isolation so a successful traversal cannot reach startup hooks or sensitive host paths; (4) monitor logs and WAF rules for traversal sequences (`../`, URL-encoded variants) in Authorization/Bearer headers and for unexpected file writes outside the configured user directory; (5) track the h2oGPT GitHub repo and the VulnCheck advisory for an official fix and apply it as soon as released.

What systems are affected by CVE-2026-65700?

This vulnerability affects the following AI/ML architecture patterns: model serving, self-hosted LLM inference APIs, agent frameworks.

What is the CVSS score for CVE-2026-65700?

CVE-2026-65700 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 1.52%.

What is the AI security impact?

Affected AI Architectures

model servingself-hosted LLM inference APIsagent frameworks

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0096 AI Service API

Compliance Controls Affected

ISO 42001: A.8.6

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string unsanitized as a path component via os.path.join, and because the default API key is EMPTY authentication is bypassed, enabling attackers to traverse outside the intended user directory through the file content, delete, and upload endpoints to achieve remote code execution by writing to startup hooks or application-loaded files.

Exploitation Scenario

An attacker scans for internet-facing h2oGPT instances exposing the OpenAI-compatible API (a common self-hosted LLM deployment pattern). Finding no meaningful authentication because the default API key is empty, the attacker sends a request to the file upload or delete endpoint with a bearer token crafted as a path-traversal string (e.g. containing repeated `../` sequences) to escape the intended per-user directory. Using the write capability, the attacker overwrites a startup hook script or an application-loaded configuration file with malicious code; when the h2oGPT service next restarts or reloads that file, the attacker's code executes with the privileges of the server process, granting full remote code execution and a foothold for lateral movement, data theft, or further compromise of the hosting environment.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.