---
id: "CVE-2026-101369"
kind: "vulnerability"
aliases: ["CVE-2026-101369"]
title: "Oracle REST Data Services: Backend-as-a-Service flaw exposes data to unauthenticated attackers"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["oracle", "oracle-rest-data-services", "runtime", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:17:44+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:04:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101369", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Oracle REST Data Services: Backend-as-a-Service flaw exposes data to unauthenticated attackers

Oracle REST Data Services has a flaw in its Backend-as-a-Service component that lets an unauthenticated attacker over HTTP read a subset of accessible data and modify or delete some of it. Exploitation requires a person other than the attacker to interact with the target, and the sources say it may affect other products as well.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Move Oracle REST Data Services to a release outside the affected range 24.2.0-26.1.0 (the fixed version is unknown from the sources).
- Check the Oracle Critical Patch Update advisory for the patched release.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101369

## From the sources

Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_