External risk intelligence

h2oGPT Path Traversal Vulnerability Allows Arbitrary File Access

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-65700

The vulnerability exists in an OpenAI-compatible API, which is typically deployed as a network-accessible web service or application interface intended to receive external requests. Such services are commonly exposed to provide programmatic access to model features, making remote, internet-facing exposure a frequent deployment pattern.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in h2oGPT's file handling, which could allow unauthenticated attackers to access, modify, or delete server files through its OpenAI-compatible API. The flaw stems from improperly handled input in the API's authentication mechanism, potentially leading to unauthorized actions and, in the worst case, remote code execution.

File access flaw allows attacker control.
Critical for systems using the OpenAI API.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to the OpenAI-compatible files API. Since the API does not require authentication and the bearer token is not properly validated, an attacker can use path traversal sequences to access files outside of the intended directory. This allows them to read, write, or delete arbitrary files on the server. If successful, an attacker could potentially achieve remote code execution by modifying startup files or other application-loaded files.

No authentication required.
Traverse directories via bearer token.
Read, write, delete arbitrary files.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could potentially read, write, or delete arbitrary files on the server. This could occur when the OpenAI-compatible files API is accessed, allowing traversal outside the intended directory through specially crafted bearer tokens.

Arbitrary server files could be accessed.
Path traversal via API requests.
Remote code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical path traversal vulnerability in h2oGPT's OpenAI-compatible files API requires immediate attention from teams managing AI or machine learning platforms. The first practical step is to identify all instances of h2oGPT, confirm their reachability and business criticality, and assign an accountable owner for remediation planning.

Platform or AI/ML engineering teams own the issue.
Verify h2oGPT instances and their exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is h2oGPT and how is it used?

h2oGPT is an open-source software framework designed for running and interacting with large language models. It provides various interfaces, including an OpenAI-compatible API, allowing developers to integrate these AI models into their own applications or workflows. It is commonly used by engineering teams to deploy local or private AI infrastructure for document analysis and generative tasks.

What is the path traversal vulnerability in CVE-2026-65700?

This vulnerability is a Path Traversal flaw (CWE-22). It occurs when the software takes user-provided input—in this case, a bearer token—and uses it to build a file path without proper validation. Because the system fails to sanitize this input, an attacker can insert special characters to break out of the intended folder, gaining the ability to read, modify, or delete sensitive files located anywhere the server process has permission to access.

How do attackers trigger this vulnerability?

An attacker triggers this by sending a crafted request to the OpenAI-compatible files API with a malicious bearer token. Because the software defaults to an empty API key, the authentication check is bypassed entirely. It is important to note that this bug is specifically linked to the file management endpoints; requests that do not involve the file API or that are correctly authenticated in a hardened configuration may not be affected by this specific traversal vector.

Is my h2oGPT instance at risk?

According to Halo Surface Signal, this vulnerability exists in an interface designed to receive network requests, which is frequently deployed as an internet-facing service. If your h2oGPT installation is accessible from the internet to support remote programmatic access to model features, your risk is significantly higher. Internal-only instances are still susceptible to lateral movement if an attacker is already present within your network perimeter.

How should I respond to CVE-2026-65700?

Start by identifying all running instances of h2oGPT within your environment to determine which ones use the OpenAI-compatible API. Once identified, evaluate whether these services are exposed to untrusted networks. Coordinate with your AI or machine learning engineering teams to restrict access to these endpoints immediately while you assess remediation options to secure the file handling mechanism.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.