{"id":"CVE-2026-101577","kind":"vulnerability","aliases":["CVE-2026-101577"],"related":[],"title":"Helidon: CORS component flaw allows limited data changes via HTTP","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors).  Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).","summary":"Helidon's helidon-cors component in versions 4.0.0 through 4.5.5 has a flaw that an unauthenticated network attacker can trigger, but it needs a victim user to take an action. A successful attack can let the attacker change, insert or delete some data that Helidon can access.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helidon","java","runtime","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the Helidon version in the project's dependency file (for example the `io.helidon` version in `pom.xml`) and look for versions `4.0.0` through `4.5.5`.\n- Check whether the application uses the helidon-cors module (`io.helidon.cors`).","fix":"- Move Helidon to a release newer than `4.5.5`, as listed in the Oracle advisory (unknown exact fixed version in sources).","status":"open","published_at":"2026-10-20T22:18:11+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:47:41+00:00","updated_at":"2026-10-25T04:47:41+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:47:41Z","model":"claude-haiku-5-5","output":{"fix":"- Move Helidon to a release newer than `4.5.5`, as listed in the Oracle advisory (unknown exact fixed version in sources).","reach":"internet","title":"Helidon: CORS component flaw allows limited data changes via HTTP","impact":"medium","summary":"Helidon's helidon-cors component in versions 4.0.0 through 4.5.5 has a flaw that an unauthenticated network attacker can trigger, but it needs a victim user to take an action. A successful attack can let the attacker change, insert or delete some data that Helidon can access.","category":"runtime","nicknames":[],"who_cares":["helidon","java","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker can modify or delete some data Helidon can access","analyst_note":"Confirm the fixed Helidon version and the exact conditions for helidon-cors exposure at the Oracle advisory and NVD entry for CVE-2026-101577.","how_to_check":"- Check the Helidon version in the project's dependency file (for example the `io.helidon` version in `pom.xml`) and look for versions `4.0.0` through `4.5.5`.\n- Check whether the application uses the helidon-cors module (`io.helidon.cors`).","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Applications built on Helidon 4.0.0 through 4.5.5 that use the helidon-cors component and expose it over HTTP. Sources do not describe further configuration conditions; teams on other Helidon versions or not using CORS handling are not indicated as affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000643,"input_tokens":3462,"output_tokens":593,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101577':13A,16A '-2026':12A,15A '/av':150C '3.1':140C,143C,149C '4.0.0':31B,90C '4.5.5':33B,91C 'access':70B,101C,132C,137C 'action':53B 'affect':88C 'allow':5A,96C 'attack':41B,56B,60B,98C,108C,118C,120C 'base':141C 'chang':8A,61B 'compon':3A,28B,80C 'compromis':105C 'cor':2A,27B,83C 'cve':11A,14A 'cvss':139C,146C,148C 'data':7A,66B,138C 'delet':64B,131C 'difficult':92C 'exploit':94C 'flaw':4A,36B 'fusion':78C 'h/pr':152C 'helidon':1A,17B,23B,26B,68B,74C,82C,106C,136C 'helidon-cor':25B,81C 'host':22B 'http':10A,103C 'human':110C 'impact':145C 'insert':62B,129C 'integr':144C 'interact':111C 'java':18B 'l/a':157C 'let':58B 'limit':6A 'middlewar':79C 'n':158C 'n/ac':151C 'n/i':156C 'n/ui':153C 'need':46B 'network':40B,100C 'oracl':77C 'person':114C 'product':75C 'r/s':154C 'requir':109C 'result':125C 'runtim':19B 'score':142C 'self':21B 'self-host':20B 'success':55B,107C,119C 'support':84C 'take':51B 'trigger':43B 'u/c':155C 'unauthent':39B,97C 'unauthor':127C 'updat':128C 'user':49B 'vector':147C 'version':30B,85C 'via':9A,102C 'victim':48B 'vulner':71C,95C,123C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Helidon 4.0.0 through 4.5.5 that use the helidon-cors component and expose it over HTTP. Sources do not describe further configuration conditions; teams on other Helidon versions or not using CORS handling are not indicated as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101577","severity":null,"published_at":"2026-10-20T22:18:11+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}