{"id":"CVE-2026-101363","kind":"vulnerability","aliases":["CVE-2026-101363"],"related":[],"title":"Oracle REST Data Services: GraphQL flaw leaks some accessible data","description":"Vulnerability in Oracle REST Data Services (component: Graph QL).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle REST Data Services' GraphQL component has a flaw that lets an unauthenticated attacker over HTTP read a subset of data the service can access. The sources describe confidentiality impact only, with no code execution or data modification.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graphql","oracle-rest-data-services","ords","package","self-hosted"],"not_affected_if":["no-graphql-endpoint","not-running-ords"],"how_to_check":"- Check the installed Oracle REST Data Services version (for example with `java -jar ords.war version` or the server's admin page) and see whether it falls in 24.2.0 through 26.1.0.\n- Check whether the GraphQL endpoint is reachable from untrusted networks.","fix":"- Move Oracle REST Data Services to a release newer than `26.1.0` once Oracle publishes a fixed build (the sources do not name the fixed version).\n- Restrict network access to the GraphQL endpoint until patched.","status":"open","published_at":"2026-10-20T22:17:43+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:24:35+00:00","updated_at":"2026-10-25T04:24:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:24:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle REST Data Services to a release newer than `26.1.0` once Oracle publishes a fixed build (the sources do not name the fixed version).\n- Restrict network access to the GraphQL endpoint until patched.","reach":"internet","title":"Oracle REST Data Services: GraphQL flaw leaks some accessible data","impact":"low","summary":"Oracle REST Data Services' GraphQL component has a flaw that lets an unauthenticated attacker over HTTP read a subset of data the service can access. The sources describe confidentiality impact only, with no code execution or data modification.","category":"package","nicknames":[],"who_cares":["oracle-rest-data-services","ords","graphql","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads a subset of data ORDS can access","analyst_note":"Find the fixed version and Oracle advisory for CVE-2026-101363 and confirm whether the GraphQL endpoint is enabled by default.","how_to_check":"- Check the installed Oracle REST Data Services version (for example with `java -jar ords.war version` or the server's admin page) and see whether it falls in 24.2.0 through 26.1.0.\n- Check whether the GraphQL endpoint is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["not-running-ords","no-graphql-endpoint"],"who_is_affected":"Teams running Oracle REST Data Services between 24.2.0 and 26.1.0 with the GraphQL component reachable over HTTP. Exposure depends on what data the ORDS database user can read, so systems with narrow schema access carry less risk. Teams not running this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000658,"input_tokens":3431,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101363':13A,16A '-2026':12A,15A '/av':132C '24.2.0':81C '26.1.0':82C '3.1':122C,131C '5.3':125C 'access':9A,52B,91C,110C,119C 'affect':79C 'allow':86C 'attack':41B,88C,101C 'base':123C 'code':61B 'compon':33B,72C 'compromis':95C 'confidenti':56B,126C 'cve':11A,14A 'cvss':121C,128C,130C 'data':3A,10A,21B,30B,48B,64B,70C,98C,117C,120C 'describ':55B 'easili':83C 'execut':62B 'exploit':84C 'flaw':6A,36B 'graph':73C 'graphql':5A,17B,32B 'host':27B 'http':43B,93C 'impact':57B,127C 'l/i':138C 'l/pr':134C 'leak':7A 'let':38B 'modif':65B 'n':140C 'n/a':139C 'n/ac':133C 'n/s':136C 'n/ui':135C 'network':90C 'oracl':1A,19B,28B,68C,96C,115C 'oracle-rest-data-servic':18B 'ord':23B 'packag':24B 'ql':74C 'read':44B,109C 'rest':2A,20B,29B,69C,97C,116C 'result':106C 'score':124C 'self':26B 'self-host':25B 'servic':4A,22B,31B,50B,71C,99C,118C 'sourc':54B 'subset':46B,113C 'success':100C 'support':75C 'u/c':137C 'unauthent':40B,87C 'unauthor':108C 'vector':129C 'version':76C 'via':92C 'vulner':66C,85C,104C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle REST Data Services between 24.2.0 and 26.1.0 with the GraphQL component reachable over HTTP. Exposure depends on what data the ORDS database user can read, so systems with narrow schema access carry less risk. Teams not running this product can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101363","severity":null,"published_at":"2026-10-20T22:17:43+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}