{"id":"CVE-2026-101590","kind":"vulnerability","aliases":["CVE-2026-101590"],"related":[],"title":"Helidon MicroProfile security: unauthenticated HTTP attacker reads and changes data","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security).  Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","summary":"Oracle Helidon 4.0.0 through 4.5.5, component helidon-microprofile-security: an unauthenticated attacker over HTTP can read and modify data the app can reach (CVSS 3.1 9.1, AV:N/AC:L/PR:N). Oracle gives no root cause. Fixed in 4.5.6.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"helidon-microprofile-security","fixed":["4.5.6"],"affected":">= 4.0.0, <= 4.5.5","ecosystem":"maven"}],"ecosystems":[],"tags":["helidon","java","microprofile","oracle-fusion-middleware","runtime"],"not_affected_if":["helidon-3x-or-earlier","helidon-version-outside-4.0.0-4.5.5","not-using-helidon-mp"],"how_to_check":"Check whether the app uses Helidon MP (io.helidon.microprofile.security or helidon-microprofile on the classpath) at a version from 4.0.0 to 4.5.5. Run: mvn dependency:tree | grep helidon, or check the io.helidon BOM or parent version in pom.xml or build.gradle. The exact trigger is unknown; treat any Helidon MP service with security enabled as exposed.","fix":"Upgrade Helidon to 4.5.6 (released 2026-10-20) or later. This is inferred from the affected range ending at 4.5.5. Oracle does not name the fixed version in the text I read.","status":"open","published_at":"2026-10-20T22:18:12+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:51+00:00","updated_at":"2026-10-23T23:08:14+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T22:38:51Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Helidon to a release later than 4.5.5; the sources do not name the fixed version.","reach":"internet","title":"Helidon MicroProfile security: unauthenticated HTTP attacker reads and changes data","impact":"high","summary":"Oracle's Helidon 4.0.0 through 4.5.5 has a flaw in its MicroProfile security component that lets a remote, unauthenticated attacker over HTTP read and modify data the service can access. The advisory rates it CVSS 9.1 with high confidentiality and integrity impact.","category":"runtime","who_cares":["helidon","java","microprofile"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker reads and modifies all data Helidon can reach","analyst_note":"Find the fixed Helidon version and the exact trigger condition in Oracle's Critical Patch Update advisory or the Helidon release notes for 4.5.6 or later.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["helidon-version-outside-4.0.0-4.5.5"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000522,"input_tokens":3108,"output_tokens":422,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed Helidon version and the exact trigger condition in Oracle's Critical Patch Update advisory or the Helidon release notes for 4.5.6 or later.","search":"'-101590':13A,16A '-2026':12A,15A '/av':155C '3.1':54B,143C,154C '4.0.0':31B,88C '4.5.5':33B,89C '4.5.6':67B '9.1':55B,146C 'access':98C,117C,124C,130C,136C,140C 'affect':86C 'allow':93C 'app':50B 'attack':6A,41B,95C,105C 'av':56B 'base':144C 'caus':64B 'chang':9A 'complet':135C 'compon':34B,77C 'compromis':102C 'confidenti':147C 'creation':113C 'critic':119C,132C 'cve':11A,14A 'cvss':53B,142C,151C,153C 'data':10A,48B,120C,125C,133C,141C 'delet':114C 'easili':90C 'exploit':91C 'fix':65B 'fusion':26B,75C 'give':61B 'h/a':162C 'h/i':161C 'helidon':1A,18A,21B,30B,36B,71C,79C,103C,123C,139C 'helidon-microprofile-secur':35B,78C 'helidon-microprofile-security':17A 'http':5A,43B,100C 'impact':150C 'integr':149C 'java':22B 'l/pr':58B,157C 'microprofil':2A,23B,37B,80C 'microprofile':19A 'middlewar':27B,76C 'modif':116C 'modifi':47B 'n':59B,163C 'n/ac':57B,156C 'n/s':159C 'n/ui':158C 'network':97C 'oracl':25B,29B,60B,74C 'oracle-fusion-middlewar':24B 'product':72C 'reach':52B 'read':7A,45B 'result':110C 'root':63B 'runtim':28B 'score':145C 'secur':3A,38B,81C 'security':20A 'success':104C 'support':82C 'u/c':160C 'unauthent':4A,40B,94C 'unauthor':112C,129C 'vector':152C 'version':83C 'via':99C 'vulner':68C,92C,108C 'well':127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101590","severity":null,"published_at":"2026-10-20T22:18:12+00:00","modified_at":"2026-10-22T23:17:59+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101590:373","url":null,"severity":null,"published_at":"2026-10-23T23:08:14+00:00","modified_at":"2026-10-23T23:08:14+00:00","first_seen_at":"2026-10-23T23:08:14+00:00","fetched_at":"2026-10-23T23:08:14+00:00","note":"Oracle CPU Oct 2026 (via CVE record): Helidon 4.0.0-4.5.5 affected, no root cause or trigger published. Helidon 4.5.6 (2026-10-20, same day as CPU) is the first later release; its changelog does not name the CVE. The 4.5.5 and 4.5.6 changelogs list MP security fixes (path-specific config, annotations on resource implementations) that could be related, but that is unconfirmed. No exploitation or PoC found; not in KEV; EPSS under 1%. Oracle CPU page not read in full; no social discussion checked."}],"documents":[{"id":1798,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101590","title":"CVE Record CVE-2026-101590 (Oracle CNA text)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1796,"url":"https://github.com/helidon-io/helidon/releases/tag/4.5.6","title":"Helidon 4.5.6 release (2026-10-20)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}