H2 Database Console - JNDI Injection RCE
CVE-2021-42392
Verified
Description
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution via the H2 web console (versions before 2.0.206 / 1.4.198 with the console enabled).
Severity
Critical
CVSS Score
9.8
Exploit Probability
83%
Affected Product
h2
Published Date
September 18, 2026
Template Author
i-am-paradox
CVE-2021-42392.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2021-42392
CWE ID:
cwe-502
References
https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/https://github.com/advisories/GHSA-h376-j262-vhq6https://github.com/h2database/h2database/commit/b24aa46f48904ce64443f8f4353d70a2eed09037https://nvd.nist.gov/vuln/detail/CVE-2021-42392https://github.com/vulhub/vulhub/tree/master/h2database/CVE-2021-42392
Remediation Steps
Upgrade H2 database to version 2.0.206 or later, and disable the web console (spring.h2.console.enabled=false) or restrict access to it.