{"id":"CVE-2026-101370","kind":"vulnerability","aliases":["CVE-2026-101370"],"related":[],"title":"Oracle REST Data Services: unauthenticated read of some data over HTTP","description":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).","summary":"Oracle REST Data Services versions 24.2.0 through 26.1.0 have a flaw in the Core component that an unauthenticated network attacker can trigger over HTTP. A successful attack gives read access to a subset of the data that the service can reach, and it needs a person other than the attacker to take an action.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-database","oracle-rest-data-services","package","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Oracle REST Data Services version against the affected range 24.2.0-26.1.0 (the sources do not give a command for this).","fix":"- Move Oracle REST Data Services to a version after `26.1.0` (the sources do not name the exact fixed release; check Oracle's advisory).","status":"open","published_at":"2026-10-20T22:17:44+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:47:45+00:00","updated_at":"2026-10-25T04:47:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:47:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle REST Data Services to a version after `26.1.0` (the sources do not name the exact fixed release; check Oracle's advisory).","reach":"network","title":"Oracle REST Data Services: unauthenticated read of some data over HTTP","impact":"low","summary":"Oracle REST Data Services versions 24.2.0 through 26.1.0 have a flaw in the Core component that an unauthenticated network attacker can trigger over HTTP. A successful attack gives read access to a subset of the data that the service can reach, and it needs a person other than the attacker to take an action.","category":"package","nicknames":[],"who_cares":["oracle-rest-data-services","oracle-database","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated read access to a subset of accessible data","analyst_note":"Find Oracle's security alert for this CVE to confirm the fixed version and any deployment conditions; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-101370 gives only the affected range.","how_to_check":"- Check the installed Oracle REST Data Services version against the affected range 24.2.0-26.1.0 (the sources do not give a command for this).","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Oracle REST Data Services in the affected range that expose it to a network over HTTP. The sources do not describe which deployment settings make it reachable, so the exact exposure is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000626,"input_tokens":3446,"output_tokens":562,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101370':14A,17A '-2026':13A,16A '/av':162C '24.2.0':35B,98C '26.1.0':37B,99C '3.1':152C,155C,161C 'access':59B,109C,140C,149C 'action':83B 'affect':96C 'allow':104C 'attack':49B,56B,79B,106C,119C,129C,131C 'base':153C 'compon':44B,90C 'compromis':113C 'confidenti':156C 'core':43B,91C 'cve':12A,15A 'cvss':151C,158C,160C 'data':3A,9A,24B,32B,65B,88C,116C,147C,150C 'databas':20B 'difficult':100C 'exploit':102C 'flaw':40B 'give':57B 'h/pr':164C 'host':29B 'http':11A,53B,111C 'human':121C 'impact':157C 'interact':122C 'l/i':168C 'n':170C 'n/a':169C 'n/ac':163C 'n/ui':165C 'need':73B 'network':48B,108C 'oracl':1A,19B,22B,30B,86C,114C,145C 'oracle-databas':18B 'oracle-rest-data-servic':21B 'packag':26B 'person':75B,125C 'r/s':166C 'reach':70B 'read':6A,58B,139C 'requir':120C 'rest':2A,23B,31B,87C,115C,146C 'result':136C 'score':154C 'self':28B 'self-host':27B 'servic':4A,25B,33B,68B,89C,117C,148C 'subset':62B,143C 'success':55B,118C,130C 'support':92C 'take':81B 'trigger':51B 'u/c':167C 'unauthent':5A,47B,105C 'unauthor':138C 'vector':159C 'version':34B,93C 'via':110C 'vulner':84C,103C,134C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle REST Data Services in the affected range that expose it to a network over HTTP. The sources do not describe which deployment settings make it reachable, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101370","severity":null,"published_at":"2026-10-20T22:17:44+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}