H2O-3 versions prior to 3.46.0.10 have a critical remote code execution vulnerability in the unauthenticated REST API endpoint /99/ImportSQLTable. The flaw is due to insufficient parameter blacklist controls that only target MySQL JDBC driver parameters, allowing attackers to bypass protections by using PostgreSQL JDBC driver parameters. This enables unauthenticated attackers to execute arbitrary code with the privileges of the H2O-3 process. The vulnerability is fixed in version 3.46.0.10.