Detections
Analytics

H2O Flow Unauthenticated Access

critical Web App Scanning Plugin ID 114969

Language:

Synopsis

H2O Flow Unauthenticated Access

Description

H2O Flow is an open-source user interface for H2O, an open-source, distributed and scalable machine learning and predictive analytics platform. By default, H2O Flow does not require authentication to access the application. This allows an attacker to access sensitive data. This detection is included in the AI and LLM category.

Solution

Authentication should be enforced to prevent unauthorized access to the H2O Flow interface.

See Also

https://docs.h2o.ai/

https://docs.h2o.ai/h2o/latest-stable/h2o-docs/flow.html

Plugin Details

Severity: Critical

ID: 114969

Type: remote

Published: 9/26/2025

Updated: 9/26/2025

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: High

Score: 7.5

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Critical

Base Score: 10

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS Score Source: Tenable

CVSS v4

Risk Factor: Critical

Base Score: 10

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS Score Source: Tenable

Reference Information