{"id":"CVE-2026-101379","kind":"vulnerability","aliases":["CVE-2026-101379"],"related":[],"title":"Oracle REST Data Services: unauthenticated HTTP request reads a subset of data","description":"Vulnerability in Oracle REST Data Services (component: ADP).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle REST Data Services has a flaw in its ADP component that lets an unauthenticated attacker reach it over HTTP. A successful attack gives read access to a subset of the data the service can reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","oracle-rest-data-services","runtime","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Oracle REST Data Services version against the affected range `24.2.0` to `26.1.0`\n- Confirm whether the ADP component is enabled in the deployment: unknown","fix":"- Move Oracle REST Data Services to a release outside `24.2.0` to `26.1.0` as published in Oracle's Critical Patch Update advisory: unknown\n- Restrict HTTP access to the service until it is patched: unknown","status":"open","published_at":"2026-10-20T22:17:45+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:24:34+00:00","updated_at":"2026-10-25T04:24:34+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:24:34Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle REST Data Services to a release outside `24.2.0` to `26.1.0` as published in Oracle's Critical Patch Update advisory: unknown\n- Restrict HTTP access to the service until it is patched: unknown","reach":"internet","title":"Oracle REST Data Services: unauthenticated HTTP request reads a subset of data","impact":"low","summary":"Oracle REST Data Services has a flaw in its ADP component that lets an unauthenticated attacker reach it over HTTP. A successful attack gives read access to a subset of the data the service can reach.","category":"runtime","nicknames":[],"who_cares":["oracle-rest-data-services","java","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads a subset of accessible data","analyst_note":"Check the Oracle Critical Patch Update advisory for the fixed version and whether ADP is enabled by default.","how_to_check":"- Check the installed Oracle REST Data Services version against the affected range `24.2.0` to `26.1.0`\n- Confirm whether the ADP component is enabled in the deployment: unknown","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Deployments of Oracle REST Data Services within the affected versions `24.2.0` to `26.1.0` that accept HTTP requests from the network are exposed. The sources do not say whether the ADP component must be enabled by default, so teams running other versions or no network-facing instance can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3427,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101379':15A,18A '-2026':14A,17A '/av':130C '24.2.0':79C '26.1.0':80C '3.1':120C,129C '5.3':123C 'access':54B,89C,108C,117C 'adp':38B,72C 'affect':77C 'allow':84C 'attack':44B,51B,86C,99C 'base':121C 'compon':39B,71C 'compromis':93C 'confidenti':124C 'cve':13A,16A 'cvss':119C,126C,128C 'data':3A,12A,23B,31B,60B,69C,96C,115C,118C 'easili':81C 'exploit':82C 'flaw':35B 'give':52B 'host':28B 'http':6A,48B,91C 'impact':125C 'java':19B 'l/i':136C 'l/pr':132C 'let':41B 'n':138C 'n/a':137C 'n/ac':131C 'n/s':134C 'n/ui':133C 'network':88C 'oracl':1A,21B,29B,67C,94C,113C 'oracle-rest-data-servic':20B 'reach':45B,64B 'read':8A,53B,107C 'request':7A 'rest':2A,22B,30B,68C,95C,114C 'result':104C 'runtim':25B 'score':122C 'self':27B 'self-host':26B 'servic':4A,24B,32B,62B,70C,97C,116C 'subset':10A,57B,111C 'success':50B,98C 'support':73C 'u/c':135C 'unauthent':5A,43B,85C 'unauthor':106C 'vector':127C 'version':74C 'via':90C 'vulner':65C,83C,102C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle REST Data Services within the affected versions `24.2.0` to `26.1.0` that accept HTTP requests from the network are exposed. The sources do not say whether the ADP component must be enabled by default, so teams running other versions or no network-facing instance can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101379","severity":null,"published_at":"2026-10-20T22:17:45+00:00","modified_at":"2026-10-21T21:17:33+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}