{"id":"CVE-2026-101586","kind":"vulnerability","aliases":["CVE-2026-101586"],"related":[],"title":"Helidon: unauthenticated network attacker gets read access to some data","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Helidon's webclient component, part of Oracle Fusion Middleware, has a flaw in versions 4.0.0 through 4.5.5 and 27.0.0. An unauthenticated attacker with network access over HTTP can read a subset of data the Helidon application can access.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helidon","java","oracle-fusion-middleware","runtime","self-hosted"],"not_affected_if":["other-versions"],"how_to_check":"- Check the Helidon version in the project's dependency file (for example, the `io.helidon` version in Maven or Gradle) and see whether it falls in `4.0.0` to `4.5.5` or is `27.0.0`.\n- unknown for whether a specific deployment uses helidon-webclient in a reachable path.","fix":"- Move Helidon to a release outside the affected range `4.0.0` to `4.5.5` and `27.0.0`; the fixed version is unknown from the sources.\n- unknown for any configuration workaround.","status":"open","published_at":"2026-10-20T22:18:12+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:23:17+00:00","updated_at":"2026-10-25T04:23:17+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:23:17Z","model":"claude-haiku-5-5","output":{"fix":"- Move Helidon to a release outside the affected range `4.0.0` to `4.5.5` and `27.0.0`; the fixed version is unknown from the sources.\n- unknown for any configuration workaround.","reach":"internet","title":"Helidon: unauthenticated network attacker gets read access to some data","impact":"low","summary":"Helidon's webclient component, part of Oracle Fusion Middleware, has a flaw in versions 4.0.0 through 4.5.5 and 27.0.0. An unauthenticated attacker with network access over HTTP can read a subset of data the Helidon application can access.","category":"runtime","nicknames":[],"who_cares":["java","helidon","oracle-fusion-middleware","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker reads a subset of data accessible to Helidon","analyst_note":"Find the Oracle advisory for CVE-2026-101586 to confirm the fixed version and any configuration that makes the webclient path reachable.","how_to_check":"- Check the Helidon version in the project's dependency file (for example, the `io.helidon` version in Maven or Gradle) and see whether it falls in `4.0.0` to `4.5.5` or is `27.0.0`.\n- unknown for whether a specific deployment uses helidon-webclient in a reachable path.","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Teams running Helidon services that use the helidon-webclient component in versions 4.0.0 through 4.5.5 or 27.0.0 are exposed. The sources do not describe which HTTP paths or configurations expose the data, so whether a given service is reachable is unknown. Teams on other Helidon versions or not using helidon-webclient can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000673,"input_tokens":3449,"output_tokens":656,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101586':13A,16A '-2026':12A,15A '/av':131C '27.0.0':45B,87C '3.1':121C,130C '4.0.0':41B,84C '4.5.5':43B,85C '5.3':124C 'access':7A,51B,64B,96C,112C,118C 'affect':82C 'allow':91C 'applic':62B 'attack':4A,48B,93C,103C 'base':122C 'compon':30B,74C 'compromis':100C 'confidenti':125C 'cve':11A,14A 'cvss':120C,127C,129C 'data':10A,59B,119C 'easili':88C 'exploit':89C 'flaw':38B 'fusion':21B,34B,72C 'get':5A 'helidon':1A,17B,27B,61B,68C,76C,101C,117C 'helidon-webcli':75C 'host':26B 'http':53B,98C 'impact':126C 'java':18B 'l/i':137C 'l/pr':133C 'middlewar':22B,35B,73C 'n':139C 'n/a':138C 'n/ac':132C 'n/s':135C 'n/ui':134C 'network':3A,50B,95C 'oracl':20B,33B,71C 'oracle-fusion-middlewar':19B 'part':31B 'product':69C 'read':6A,55B,111C 'result':108C 'runtim':23B 'score':123C 'self':25B 'self-host':24B 'subset':57B,115C 'success':102C 'support':78C 'u/c':136C 'unauthent':2A,47B,92C 'unauthor':110C 'vector':128C 'version':40B,79C 'via':97C 'vulner':65C,90C,106C 'webclient':29B,77C","nicknames":[],"mitigations":[],"who_affected":"Teams running Helidon services that use the helidon-webclient component in versions 4.0.0 through 4.5.5 or 27.0.0 are exposed. The sources do not describe which HTTP paths or configurations expose the data, so whether a given service is reachable is unknown. Teams on other Helidon versions or not using helidon-webclient can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101586","severity":null,"published_at":"2026-10-20T22:18:12+00:00","modified_at":"2026-10-21T18:39:21+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}