Live › vulnerability › CVE-2026-101363
Go to dashboardOracle REST Data Services' GraphQL component has a flaw that lets an unauthenticated attacker over HTTP read a subset of data the service can access. The sources describe confidentiality impact only, with no code execution or data modification.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle REST Data Services between 24.2.0 and 26.1.0 with the GraphQL component reachable over HTTP. Exposure depends on what data the ORDS database user can read, so systems with narrow schema access carry less risk. Teams not running this product can skip it.
No product ranges from the sources yet.
java -jar ords.war version or the server's admin page) and see whether it falls in 24.2.0 through 26.1.0.26.1.0 once Oracle publishes a fixed build (the sources do not name the fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101363")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.