This vulnerability affects h2oai h2o-3 up to version 7402 in the Rapids setproperty Primitive Handler, specifically in the exec function of h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java. It allows remote attackers to perform actions that bypass proper access controls. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited impact on integrity. The vendor was contacted but did not respond, and no official patch or remediation guidance is currently available.

The vulnerability enables remote attackers to bypass access controls in the affected component, potentially allowing unauthorized manipulation of properties or settings within the h2o-3 platform. This could lead to unauthorized changes impacting system integrity. However, there is no indication of confidentiality or availability impact. Exploitation requires no privileges or user interaction, increasing the risk of remote compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting network access to the affected service and monitor for any suspicious activity related to the Rapids setproperty Primitive Handler. Avoid exposing the vulnerable component to untrusted networks until a patch or official mitigation is released.