Live › vulnerability › CVE-2026-87354
Go to dashboardOracle TimesTen In-Memory Database's Kubernetes Operator has a flaw that lets a low-privileged user with network access over HTTPS read a subset of the data the database holds. The CVSS 3.1 score is 4.3, with impact on confidentiality only.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run the Oracle TimesTen Kubernetes Operator on the affected version ranges, where low-privileged users can reach its HTTPS interface over the network. Installations without the operator, or on versions outside the listed ranges, are not affected. The sources do not say which default configuration exposes the HTTPS endpoint.
No product ranges from the sources yet.
22.1 through 22.1.40.0 and 26.1 through 26.1.1.2.0.kubectl get deployments -A.22.1.40.0 or 26.1.1.2.0; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle TimesTen In-Memory Database (component: Kubernetes Operator). Supported versions that are affected are 22.1-22.1.40.0 and 26.1-26.1.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle TimesTen In-Memory Database. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-87354")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.