H2O.ai H2O versions up to 3.46.0.7 are vulnerable to deserialization attacks via the JDBC Connection URL. An attacker able to send a POST request to the ImportSQLTable URI with a crafted JSON payload containing a malicious connection_url can exploit this flaw. This vulnerability allows arbitrary code execution and unauthorized file reads without requiring authentication.