{"id":"CVE-2026-101588","kind":"vulnerability","aliases":["CVE-2026-101588"],"related":[],"title":"Helidon WebSocket flaw lets unauthenticated network attackers read some data","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Helidon, Oracle's Java microservices framework, has a flaw in its WebSocket component that an unauthenticated attacker can reach over HTTP. A successful attack gives read access to a subset of data that Helidon can reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helidon","java","runtime","self-hosted","websocket"],"not_affected_if":["no-helidon","no-websocket-endpoints"],"how_to_check":"- Check the Helidon version in the project's pom.xml or build file for `4.0.0` through `4.5.5` or `27.0.0`\n- Confirm whether the application exposes WebSocket endpoints (unknown which endpoints are affected)","fix":"- Move Helidon to a release newer than the affected range `4.0.0`-`4.5.5` and `27.0.0` (the fixed version is unknown from the sources)\n- Check Oracle's Critical Patch Update advisory for the patched release (unknown)","status":"open","published_at":"2026-10-20T22:18:12+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:23:16+00:00","updated_at":"2026-10-25T04:23:16+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:23:16Z","model":"claude-haiku-5-5","output":{"fix":"- Move Helidon to a release newer than the affected range `4.0.0`-`4.5.5` and `27.0.0` (the fixed version is unknown from the sources)\n- Check Oracle's Critical Patch Update advisory for the patched release (unknown)","reach":"internet","title":"Helidon WebSocket flaw lets unauthenticated network attackers read some data","impact":"low","summary":"Helidon, Oracle's Java microservices framework, has a flaw in its WebSocket component that an unauthenticated attacker can reach over HTTP. A successful attack gives read access to a subset of data that Helidon can reach.","category":"runtime","nicknames":[],"who_cares":["java","helidon","websocket","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker reads a subset of Helidon-accessible data","analyst_note":"Find the fixed Helidon version and the exact WebSocket trigger in Oracle's CVE-2026-101588 advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-101588.","how_to_check":"- Check the Helidon version in the project's pom.xml or build file for `4.0.0` through `4.5.5` or `27.0.0`\n- Confirm whether the application exposes WebSocket endpoints (unknown which endpoints are affected)","needs_analyst":true,"not_affected_if":["no-helidon","no-websocket-endpoints"],"who_is_affected":"Applications built on Helidon 4.0.0 through 4.5.5 or 27.0.0 that serve WebSocket endpoints over HTTP are exposed, since the attacker needs no account. Teams not running Helidon, or not serving WebSocket traffic, can skip it. The sources do not say which WebSocket paths or configurations trigger the flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":3445,"output_tokens":682,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101588':13A,16A '-2026':12A,15A '/av':124C '27.0.0':80C '3.1':114C,123C '4.0.0':77C '4.5.5':78C '5.3':117C 'access':50B,89C,105C,111C 'affect':75C 'allow':84C 'attack':7A,40B,47B,86C,96C 'base':115C 'compon':36B,69C 'compromis':93C 'confidenti':118C 'cve':11A,14A 'cvss':113C,120C,122C 'data':10A,55B,112C 'easili':81C 'exploit':82C 'flaw':3A,32B 'framework':29B 'fusion':67C 'give':48B 'helidon':1A,17B,24B,57B,63C,94C,110C 'host':22B 'http':44B,91C 'impact':119C 'java':18B,27B 'l/i':130C 'l/pr':126C 'let':4A 'microservic':28B 'middlewar':68C 'n':132C 'n/a':131C 'n/ac':125C 'n/s':128C 'n/ui':127C 'network':6A,88C 'oracl':25B,66C 'product':64C 'reach':42B,59B 'read':8A,49B,104C 'result':101C 'runtim':19B 'score':116C 'self':21B 'self-host':20B 'subset':53B,108C 'success':46B,95C 'support':71C 'u/c':129C 'unauthent':5A,39B,85C 'unauthor':103C 'vector':121C 'version':72C 'via':90C 'vulner':60C,83C,99C 'websocket':2A,23B,35B,70C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Helidon 4.0.0 through 4.5.5 or 27.0.0 that serve WebSocket endpoints over HTTP are exposed, since the attacker needs no account. Teams not running Helidon, or not serving WebSocket traffic, can skip it. The sources do not say which WebSocket paths or configurations trigger the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101588","severity":null,"published_at":"2026-10-20T22:18:12+00:00","modified_at":"2026-10-21T18:39:21+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}