H2 AUTO_SERVER=TRUE fails with "Access to the class org.h2.server.TcpServer is denied" [90134] since 26.2

[BenjyNStrauss]

Description

Since upgrading from 26.1.1, connecting to an H2 Embedded V.2 database with AUTO_SERVER=TRUE fails whenever DBeaver is the first process to open the database file:

org.h2.jdbc.JdbcSQLNonTransientException: Access to the class "org.h2.server.TcpServer" is denied; SQL statement:
CREATE ALIAS IF NOT EXISTS STOP_SERVER FOR 'org.h2.server.TcpServer.stopServer' [90134-240]

H2's default for h2.allowedClasses is "*", so DBeaver appears to now set a restricted h2.allowedClasses at runtime. H2 needs org.h2.server.TcpServer to start the TCP server used by AUTO_SERVER, and that class isn't allowed.

Adding -Dh2.allowedClasses=* to dbeaver.ini does not help. I confirmed with ps that the option reaches the JVM, so the value seems to be overwritten inside the application.

Expected: AUTO_SERVER=TRUE works as it did in 26.1.1. If the restriction is intentional hardening, H2's own internal classes (at least org.h2.server.TcpServer) should be allowed, or there should be a way to opt out.

DBeaver Version

Community Edition 26.2.2 (also reproduced in 26.2.1; works in 26.1.1)

Operating System

Debian, Trixie, x86_64, installed from the .deb package

Database and driver

H2 Embedded V.2, H2 driver 2.4.240

Steps to reproduce

1. Create an H2 Embedded V2.4 connection to a file database with AUTO_SERVER=TRUE in the URL, e.g. jdbc:h2:/path/to/db;AUTO_SERVER=TRUE
2. Make sure no other process has the database open
3. Connect. The error above appears.

Additional context

Bug report was generated with Claude.ai in response to attempting to debug the described issue, it was checked and verified by a human (Benjamin Strauss)

[davestokes]

@BenjyNStrauss Thank you for your report.

[ShadelessFox]

Hello @BenjyNStrauss,

We've included some security measures regarding H2.

You can configure a list of allowed classes H2 can load here:

[BenjyNStrauss]

Hi ShadelessFox, I hope it's not too much to ask, if you guys could add a button to disable the new security features? Or maybe add this configuration out of the box? (I'm only a semi-technical user) -BNS

…

On Thu, Oct 15, 2026 at 4:43 AM ShadelessFox ***@***.***> wrote: *ShadelessFox* left a comment (dbeaver/dbeaver#42367) <#42367 (comment)> Hello @BenjyNStrauss <https://github.com/BenjyNStrauss>, We've included some security measures regarding H2. You can configure a list of allowed classes H2 can load here: Image: Image (view on web) <https://github.com/user-attachments/assets/d7fb210e-5288-426f-a081-bc2e9cd3540e> — Reply to this email directly, view it on GitHub <#42367?email_source=notifications&email_token=ANZTJDBZYLQEREUS6REQV4D5UDPBTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMJZGQ4DAOBVHEZ2M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-6194808593>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ANZTJDGON7M3R5WAOYYBD535UDPBTAVCNFSNUABEKJSXA33TNF2G64TZHM2DINRWGI3DMOJ3JFZXG5LFHM2TOOBVGEYTAMBYHCQXMAQ> . You are receiving this because you were mentioned.Message ID: <dbeaver/dbeaver/issues/42367/6194808593 ***@***.***>

[ShadelessFox]

to disable the new security features

It's already possible by replacing everything in the field with *, although highly not recommended.

Just add a new line org.h2.server.TcpServer there; it should do the trick.

[BenjyNStrauss]

Thanks for the tip. I downgraded back to 26.1.1 for now. I'll try it when I decide to upgrade again. -BNS

…

On Thu, Oct 15, 2026 at 6:44 AM ShadelessFox ***@***.***> wrote: *ShadelessFox* left a comment (dbeaver/dbeaver#42367) <#42367 (comment)> to disable the new security features It's already possible by replacing everything in the field with *, although highly not recommended. Just add a new line org.h2.server.TcpServer there; it should do the trick. — Reply to this email directly, view it on GitHub <#42367?email_source=notifications&email_token=ANZTJDECF4EUABKEW6FPJAT5UD5HDA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMJZG4ZTENJVG442M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-6197325579>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ANZTJDBP7YVSSOFYUXW7C2T5UD5HDAVCNFSNUABEKJSXA33TNF2G64TZHM2DINRWGI3DMOJ3JFZXG5LFHM2TOOBVGEYTAMBYHCQXMAQ> . You are receiving this because you were mentioned.Message ID: <dbeaver/dbeaver/issues/42367/6197325579 ***@***.***>