CVE-2026-65700: h2oGPT Path Traversal — Detection and Hardening Guide

CVE-2026-65700 has been published in the NVD with a Critical CVSS score of 9.8, flagging a severe remote code execution (RCE) risk in h2oGPT versions through 0.2.1. For organizations leveraging open-source LLM frameworks, this is a priority-one incident. The vulnerability allows unauthenticated remote attackers to bypass authentication and read, write, or delete arbitrary files on the host system by exploiting a path traversal flaw in the OpenAI-compatible API implementation. Given the widespread deployment of h2oGPT in research and enterprise environments, the exposure surface is significant. Defenders must assume active scanning for this flaw and apply immediate containment strategies.

Technical Analysis

Affected Product: h2oGPT (versions through 0.2.1) CVE Identifier: CVE-2026-65700 CVSS Score: 9.8 (Critical) Attack Vector: Network

The vulnerability resides in openai_server/backend_utils.py, specifically within the get_user_dir function. This function constructs file paths using os.path.join based on the user-provided Bearer token string found in the HTTP Authorization header. Crucially, the string is used unsanitized.

Because the default configuration of h2oGPT utilizes an empty API key, authentication is effectively bypassed. An attacker can submit a malicious Bearer token containing directory traversal sequences (e.g., ../../etc/passwd). When the application processes file requests—such as content retrieval, deletion, or uploads—the traversal sequence breaks out of the intended user directory context. This grants the attacker the ability to:

1. Read: Access sensitive configuration files, API keys, or source code.
2. Write: Upload malicious scripts or overwrite existing binaries (leading to RCE).
3. Delete: Disrupt the service by removing critical system files or application data.

This is a classic "input sanitization" failure compounded by an "insecure default" configuration, creating a trivially exploitable pathway for full server compromise.

Detection & Response

Identifying exploitation attempts requires analyzing HTTP access logs for anomalies in the Authorization header. Since standard web server logs often do not log headers by default, detection relies heavily on WAF logs or custom application logging.

Sigma Rules

The following rules target the specific behavior of injecting path traversal sequences into the Authorization header and accessing the vulnerable API endpoints.

---
title: h2oGPT Path Traversal via Authorization Header
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential path traversal attempts in the Authorization header targeting h2oGPT CVE-2026-65700.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65700
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.65700
logsource:
  category: webserver
  product: apache
  # Note: Adjust product to nginx or iis based on environment. Requires request_header logging.
detection:
  selection:
    cs_uri_path|contains:
      - '/v1/files/content'
      - '/v1/files/delete'
      - '/v1/files/upload'
  filter_traversal:
    cs_header_authorization|contains:
      - '../'
      - '..%5c'
      - '%2e%2e'
  condition: selection and filter_traversal
falsepositives:
  - Misconfigured clients sending malformed headers
level: critical
---
title: h2oGPT Webshell Upload Activity
id: b2c3d4e5-6789-01bc-def1-234567890bcd
status: experimental
description: Detects potential webshell upload artifacts resulting from successful exploitation of CVE-2026-65700.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65700
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/tmp/'
      - '/var/www/html/'
      - '/public/'
    TargetFilename|endswith:
      - '.php'
      - '.py'
      - '.sh'
  condition: selection
falsepositives:
  - Legitimate administrative file uploads
level: high

KQL (Microsoft Sentinel / Defender)

This query assumes ingestion of Syslog or W3C logs where the HTTP request headers are captured. It hunts for the specific API endpoints combined with traversal syntax in the Authorization field.

// Hunt for h2oGPT Path Traversal attempts (CVE-2026-65700)
Syslog
| where EventLevelName in ("Error", "Warning", "Information")
| extend AuthHeader = extract(@'Authorization:\s*([^\s]+)', 1, Message)
| extend UriPath = extract(@'(GET|POST|PUT|DELETE)\s+([^\s]+)', 2, Message)
| where UriPath has_any ("/v1/files/content", "/v1/files/delete", "/v1/files/upload")
| where AuthHeader has "../" or AuthHeader has "%2e%2e" or AuthHeader has "..%5c"
| project TimeGenerated, Computer, Message, AuthHeader, UriPath
| order by TimeGenerated desc

Velociraptor VQL

This artifact hunts for the presence of the vulnerable h2oGPT process and checks for the specific vulnerable file structure on the host.

-- Hunt for h2oGPT installations and vulnerable backend_utils.py
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe
FROM pslist()
WHERE Name = "python" 
   AND CommandLine =~ "openai_server"

-- Check for vulnerable file version on disk
SELECT 
  FullPath, 
  Mtime, 
  Size
FROM glob(globs="/usr/local/lib/python*/dist-packages/h2ogpt/openai_server/backend_utils.py")
WHERE Mtime < timestamp("2026-04-01") 
   -- Adjust date based on patch release, checking for older files
   OR FullPath LIKE "%0.2.1%"

Remediation Script (Bash)

This script checks for the presence of the vulnerable component and aids in verification.

#!/bin/bash

# Check for h2oGPT installation via pip
CHECK_PIP=$(pip list 2>/dev/null | grep -i h2ogpt)

# Check for the vulnerable file path existence
VULN_FILE=$(find /usr -name "backend_utils.py" -path "*h2ogpt*" 2>/dev/null)

echo "[+] Scanning for CVE-2026-65700 vulnerability..."

if [[ -n "$CHECK_PIP" ]]; then
    echo "[!] h2oGPT is installed: $CHECK_PIP"
    echo "[!] Please verify the version is NOT 0.2.1 or older."
fi

if [[ -n "$VULN_FILE" ]]; then
    echo "[!] Vulnerable file found at: $VULN_FILE"
    echo "[!] Recommendation: Update h2oGPT immediately using: pip install --upgrade h2ogpt"
    
    # Check for empty API key usage (Heuristic check)
    if grep -q "EMPTY_API_KEY" "$VULN_FILE" 2>/dev/null || grep -q "os.environ.get(\"OPENAI_API_KEY\", \"\")" "$VULN_FILE" 2>/dev/null; then
        echo "[!] WARNING: Default empty API key configuration detected in source."
    fi
else
    echo "[-] No vulnerable h2oGPT files found in standard system paths."
fi

echo "[+] Action: Restart any running h2oGPT services after patching."

Remediation

1. Patch Immediately: Upgrade h2oGPT to the latest version available from the official repository. Ensure the version is strictly greater than 0.2.1.
2. Verify API Key Configuration: As a temporary interim mitigation if patching is delayed, ensure a strong, non-empty API key is configured. Note that this only mitigates the authentication bypass aspect; the underlying path traversal (os.path.join usage) still exists and may be exploitable if the attacker guesses or obtains the key. Patching is the only permanent fix.
3. Network Segmentation: Ensure h2oGPT instances are not exposed directly to the public internet. Place them behind a reverse proxy with strict header validation and IP whitelisting.
4. Audit File Systems: If you suspect exploitation has already occurred, conduct a forensic review of file systems for unauthorized modifications, specifically looking for new Python scripts or configuration changes in directories writable by the h2oGPT process.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub