{"id":"CVE-2026-101369","kind":"vulnerability","aliases":["CVE-2026-101369"],"related":[],"title":"Oracle REST Data Services: Backend-as-a-Service flaw exposes data to unauthenticated attackers","description":"Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","summary":"Oracle REST Data Services has a flaw in its Backend-as-a-Service component that lets an unauthenticated attacker over HTTP read a subset of accessible data and modify or delete some of it. Exploitation requires a person other than the attacker to interact with the target, and the sources say it may affect other products as well.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","oracle-rest-data-services","runtime","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- Move Oracle REST Data Services to a release outside the affected range 24.2.0-26.1.0 (the fixed version is unknown from the sources).\n- Check the Oracle Critical Patch Update advisory for the patched release.","status":"open","published_at":"2026-10-20T22:17:44+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:04:01+00:00","updated_at":"2026-10-25T04:04:01+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:04:01Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle REST Data Services to a release outside the affected range 24.2.0-26.1.0 (the fixed version is unknown from the sources).\n- Check the Oracle Critical Patch Update advisory for the patched release.","reach":"internet","title":"Oracle REST Data Services: Backend-as-a-Service flaw exposes data to unauthenticated attackers","impact":"medium","summary":"Oracle REST Data Services has a flaw in its Backend-as-a-Service component that lets an unauthenticated attacker over HTTP read a subset of accessible data and modify or delete some of it. Exploitation requires a person other than the attacker to interact with the target, and the sources say it may affect other products as well.","category":"runtime","nicknames":[],"who_cares":["oracle-rest-data-services","oracle","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthenticated attacker reads and alters some database-backed data","analyst_note":"Confirm the fixed Oracle REST Data Services version and whether Backend-as-a-Service is enabled by default, via the Oracle CPU advisory.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Deployments of Oracle REST Data Services in the affected versions 24.2.0 through 26.1.0 that expose the Backend-as-a-Service component over HTTP are exposed. The sources do not say whether the component is enabled by default, so teams not running Oracle REST Data Services in those versions can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000644,"input_tokens":3538,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101369':18A,21A '-2026':17A,20A '/av':210C '24.2.0':109C '26.1.0':110C '3.1':198C,209C '6.1':201C 'access':58B,119C,171C,179C,186C,195C 'addit':154C 'affect':86B,107C 'allow':114C 'attack':15A,51B,74B,116C,129C,139C,150C,159C 'backend':6A,42B,99C 'backend-as-a-servic':5A,41B,98C 'base':199C 'c/c':215C 'chang':157C 'compon':46B,97C 'compromis':123C 'confidenti':202C 'cve':16A,19A 'cvss':197C,206C,208C 'data':3A,12A,26B,34B,59B,95C,126C,148C,177C,180C,193C,196C 'delet':63B,170C 'easili':111C 'exploit':67B,112C 'expos':11A 'flaw':10A,38B 'host':31B 'http':53B,121C 'human':131C 'impact':153C,205C 'insert':168C 'integr':204C 'interact':76B,132C 'l/a':217C 'l/i':216C 'l/pr':212C 'let':48B 'may':85B,151C 'modifi':61B 'n':218C 'n/ac':211C 'n/ui':213C 'network':118C 'oracl':1A,22B,24B,32B,93C,124C,146C,175C,191C 'oracle-rest-data-servic':23B 'person':70B,135C 'product':88B,155C 'r/s':214C 'read':54B,185C 'requir':68B,130C 'rest':2A,25B,33B,94C,125C,147C,176C,192C 'result':164C 'runtim':28B 'say':83B 'scope':156C 'score':200C 'self':30B 'self-host':29B 'servic':4A,9A,27B,35B,45B,96C,102C,127C,149C,178C,194C 'signific':152C 'sourc':82B 'subset':56B,189C 'success':128C,158C 'support':103C 'target':79B 'unauthent':14A,50B,115C 'unauthor':166C,184C 'updat':167C 'vector':207C 'version':104C 'via':120C 'vulner':91C,113C,143C,162C 'well':90B,182C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle REST Data Services in the affected versions 24.2.0 through 26.1.0 that expose the Backend-as-a-Service component over HTTP are exposed. The sources do not say whether the component is enabled by default, so teams not running Oracle REST Data Services in those versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101369","severity":null,"published_at":"2026-10-20T22:17:44+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}