{"id":"CVE-2026-101571","kind":"vulnerability","aliases":["CVE-2026-101571"],"related":[],"title":"Helidon: IDCS mapper flaw exposes data to low-privileged local users","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-idcs-mapper).  Supported versions that are affected are 3.0.0-3.2.21 and 4.0.0-4.5.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Helidon executes to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).","summary":"Oracle's Helidon framework has a flaw in its IDCS mapper security provider. A low-privileged user with logon access to the host where Helidon runs can reach data Helidon handles, with a scope change that can affect other products.","severity":"medium","cvss":5.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helidon","java","oracle-fusion-middleware","runtime","self-hosted"],"not_affected_if":["default-config","no-idcs-mapper"],"how_to_check":"- Check the Helidon version in the project's pom.xml or build file, or with `mvn dependency:list | grep helidon-security-providers-idcs-mapper`\n- Look for the helidon-security-providers-idcs-mapper artifact in the dependency tree","fix":"- Upgrade helidon-security-providers-idcs-mapper to a version above `3.2.21` on the 3.x line, or above `4.5.5` on the 4.x line\n- Rebuild and redeploy the Helidon application after the upgrade","status":"open","published_at":"2026-10-20T22:18:10+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:10:35+00:00","updated_at":"2026-10-25T04:10:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:10:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade helidon-security-providers-idcs-mapper to a version above `3.2.21` on the 3.x line, or above `4.5.5` on the 4.x line\n- Rebuild and redeploy the Helidon application after the upgrade","reach":"local","title":"Helidon: IDCS mapper flaw exposes data to low-privileged local users","impact":"medium","summary":"Oracle's Helidon framework has a flaw in its IDCS mapper security provider. A low-privileged user with logon access to the host where Helidon runs can reach data Helidon handles, with a scope change that can affect other products.","category":"runtime","nicknames":[],"who_cares":["helidon","java","oracle-fusion-middleware","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local attacker reads data Helidon can access","analyst_note":"Check the Oracle Critical Patch Update advisory and the Helidon release notes for the fixed version and whether the IDCS mapper module is enabled by default.","how_to_check":"- Check the Helidon version in the project's pom.xml or build file, or with `mvn dependency:list | grep helidon-security-providers-idcs-mapper`\n- Look for the helidon-security-providers-idcs-mapper artifact in the dependency tree","needs_analyst":true,"not_affected_if":["default-config","no-idcs-mapper"],"who_is_affected":"Teams running Helidon 3.0.0 through 3.2.21 or 4.0.0 through 4.5.5 that use the IDCS mapper security provider. The attacker needs a local login on the machine or container where Helidon executes, so exposure is lowest for services with no shared shell access. Teams on other Helidon versions or without the IDCS mapper module can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":3517,"output_tokens":651,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101571':15A,18A '-2026':14A,17A '/av':162C '3.0.0':92C '3.1':152C,161C '3.2.21':93C '4.0.0':95C '4.5.5':96C '5.6':155C 'access':49B,139C,145C,149C 'addit':126C 'affect':67B,90C 'allow':101C 'attack':104C,122C,131C 'base':153C 'c/c':167C 'chang':64B,129C 'complet':144C 'compon':79C 'compromis':114C 'confidenti':156C 'critic':141C 'cve':13A,16A 'cvss':151C,158C,160C 'data':6A,58B,142C,150C 'difficult':97C 'execut':112C 'exploit':99C 'expos':5A 'flaw':4A,35B 'framework':32B 'fusion':23B,77C 'h/i':168C 'h/pr':164C 'handl':60B 'helidon':1A,19B,31B,54B,59B,73C,81C,111C,115C,121C,148C 'helidon-security-providers-idcs-mapp':80C 'host':28B,52B 'idc':2A,38B,84C 'impact':125C,157C 'infrastructur':109C 'java':20B 'l/ac':163C 'l/ui':165C 'local':11A 'logon':48B,106C 'low':9A,44B,102C 'low-privileg':8A,43B 'mapper':3A,39B,85C 'may':123C 'middlewar':24B,78C 'n':170C 'n/a':169C 'n/s':166C 'oracl':22B,29B,76C 'oracle-fusion-middlewar':21B 'privileg':10A,45B,103C 'product':69B,74C,127C 'provid':41B,83C 'reach':57B 'result':136C 'run':55B 'runtim':25B 'scope':63B,128C 'score':154C 'secur':40B,82C 'self':27B 'self-host':26B 'signific':124C 'success':130C 'support':86C 'unauthor':138C 'user':12A,46B 'vector':159C 'version':87C 'vulner':70C,100C,118C,134C","nicknames":[],"mitigations":[],"who_affected":"Teams running Helidon 3.0.0 through 3.2.21 or 4.0.0 through 4.5.5 that use the IDCS mapper security provider. The attacker needs a local login on the machine or container where Helidon executes, so exposure is lowest for services with no shared shell access. Teams on other Helidon versions or without the IDCS mapper module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101571","severity":null,"published_at":"2026-10-20T22:18:10+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}