---
id: "CVE-2026-101571"
kind: "vulnerability"
aliases: ["CVE-2026-101571"]
title: "Helidon: IDCS mapper flaw exposes data to low-privileged local users"
severity: "medium"
cvss: 5.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["helidon", "java", "oracle-fusion-middleware", "runtime", "self-hosted"]
not_affected_if: ["default-config", "no-idcs-mapper"]
published_at: "2026-10-20T22:18:10+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:10:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101571", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Helidon: IDCS mapper flaw exposes data to low-privileged local users

Oracle's Helidon framework has a flaw in its IDCS mapper security provider. A low-privileged user with logon access to the host where Helidon runs can reach data Helidon handles, with a scope change that can affect other products.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Helidon version in the project's pom.xml or build file, or with `mvn dependency:list | grep helidon-security-providers-idcs-mapper`
- Look for the helidon-security-providers-idcs-mapper artifact in the dependency tree

## Fix

- Upgrade helidon-security-providers-idcs-mapper to a version above `3.2.21` on the 3.x line, or above `4.5.5` on the 4.x line
- Rebuild and redeploy the Helidon application after the upgrade

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101571

## From the sources

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-idcs-mapper).  Supported versions that are affected are 3.0.0-3.2.21 and 4.0.0-4.5.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Helidon executes to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_