---
id: "CVE-2026-101577"
kind: "vulnerability"
aliases: ["CVE-2026-101577"]
title: "Helidon: CORS component flaw allows limited data changes via HTTP"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["helidon", "java", "runtime", "self-hosted"]
not_affected_if: ["unaffected-version"]
published_at: "2026-10-20T22:18:11+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:47:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101577", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Helidon: CORS component flaw allows limited data changes via HTTP

Helidon's helidon-cors component in versions 4.0.0 through 4.5.5 has a flaw that an unauthenticated network attacker can trigger, but it needs a victim user to take an action. A successful attack can let the attacker change, insert or delete some data that Helidon can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Helidon version in the project's dependency file (for example the `io.helidon` version in `pom.xml`) and look for versions `4.0.0` through `4.5.5`.
- Check whether the application uses the helidon-cors module (`io.helidon.cors`).

## Fix

- Move Helidon to a release newer than `4.5.5`, as listed in the Oracle advisory (unknown exact fixed version in sources).

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101577

## From the sources

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors).  Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_