This vulnerability affects h2oai h2o-3 up to version 7402 in the Rapids setproperty Primitive Handler, specifically in the exec function of h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java. It allows an attacker to bypass proper access controls remotely, potentially manipulating properties or settings improperly. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, no privileges required, no user interaction, and partial impact on integrity. The vendor has not provided any response or patch, and no official remediation is currently available.

An attacker can remotely exploit this vulnerability without authentication or user interaction to bypass access controls in the affected component. This could lead to unauthorized manipulation of properties or settings within the h2o-3 platform, potentially impacting system integrity. There is no indication of confidentiality or availability impact. Exploit code is publicly available, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting network access to the affected service and monitor for suspicious activity related to the Rapids setproperty Primitive Handler. Avoid exposing the vulnerable version 7402 to untrusted networks until a patch or official mitigation is released.