---
id: "CVE-2026-101590"
kind: "vulnerability"
aliases: ["CVE-2026-101590"]
title: "Helidon MicroProfile security: unauthenticated HTTP attacker reads and changes data"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "helidon-microprofile-security", "fixed": ["4.5.6"], "affected": ">= 4.0.0, <= 4.5.5", "ecosystem": "maven"}]
ecosystems: []
tags: ["helidon", "java", "microprofile", "oracle-fusion-middleware", "runtime"]
not_affected_if: ["helidon-3x-or-earlier", "helidon-version-outside-4.0.0-4.5.5", "not-using-helidon-mp"]
published_at: "2026-10-20T22:18:12+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-23T23:08:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101590", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:08:14+00:00"}]
---

# Helidon MicroProfile security: unauthenticated HTTP attacker reads and changes data

Oracle Helidon 4.0.0 through 4.5.5, component helidon-microprofile-security: an unauthenticated attacker over HTTP can read and modify data the app can reach (CVSS 3.1 9.1, AV:N/AC:L/PR:N). Oracle gives no root cause. Fixed in 4.5.6.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:helidon-microprofile-security affected >= 4.0.0, <= 4.5.5 fixed 4.5.6

## How to check

Check whether the app uses Helidon MP (io.helidon.microprofile.security or helidon-microprofile on the classpath) at a version from 4.0.0 to 4.5.5. Run: mvn dependency:tree | grep helidon, or check the io.helidon BOM or parent version in pom.xml or build.gradle. The exact trigger is unknown; treat any Helidon MP service with security enabled as exposed.

## Fix

Upgrade Helidon to 4.5.6 (released 2026-10-20) or later. This is inferred from the affected range ending at 4.5.5. Oracle does not name the fixed version in the text I read.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101590
- 2026-10-23T23:08:14+00:00 analyst — Oracle CPU Oct 2026 (via CVE record): Helidon 4.0.0-4.5.5 affected, no root cause or trigger published. Helidon 4.5.6 (2026-10-20, same day as CPU) is the first later release; its changelog does not name the CVE. The 4.5.5 and 4.5.6 changelogs list MP security fixes (path-specific config, annotations on resource implementations) that could be related, but that is unconfirmed. No exploitation or PoC found; not in KEV; EPSS under 1%. Oracle CPU page not read in full; no social discussion checked.

## Documents

- [advisory] CVE Record CVE-2026-101590 (Oracle CNA text) https://www.cve.org/CVERecord?id=CVE-2026-101590
- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Helidon 4.5.6 release (2026-10-20) https://github.com/helidon-io/helidon/releases/tag/4.5.6

## From the sources

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security).  Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_