{"id":"CVE-2026-87354","kind":"vulnerability","aliases":["CVE-2026-87354"],"related":[],"title":"Oracle TimesTen Kubernetes Operator: low-privilege user reads some database data","description":"Vulnerability in Oracle TimesTen In-Memory Database (component: Kubernetes Operator).  Supported versions that are affected are 22.1-22.1.40.0 and  26.1-26.1.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle TimesTen In-Memory Database.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle TimesTen In-Memory Database's Kubernetes Operator has a flaw that lets a low-privileged user with network access over HTTPS read a subset of the data the database holds. The CVSS 3.1 score is 4.3, with impact on confidentiality only.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["databases","kubernetes","oracle-timesten","package"],"not_affected_if":["operator-not-deployed"],"how_to_check":"- Check the TimesTen version in use against the affected ranges: `22.1` through `22.1.40.0` and `26.1` through `26.1.1.2.0`.\n- Check whether the TimesTen Kubernetes Operator is deployed in the cluster, for example with `kubectl get deployments -A`.","fix":"- Move the TimesTen Kubernetes Operator to a release newer than `22.1.40.0` or `26.1.1.2.0`; the sources do not name the fixed version.\n- Check Oracle's Critical Patch Update advisory for the patched release: unknown.","status":"open","published_at":"2026-10-20T22:20:13+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:39:08+00:00","updated_at":"2026-10-25T04:39:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:39:08Z","model":"claude-haiku-5-5","output":{"fix":"- Move the TimesTen Kubernetes Operator to a release newer than `22.1.40.0` or `26.1.1.2.0`; the sources do not name the fixed version.\n- Check Oracle's Critical Patch Update advisory for the patched release: unknown.","reach":"network","title":"Oracle TimesTen Kubernetes Operator: low-privilege user reads some database data","impact":"low","summary":"Oracle TimesTen In-Memory Database's Kubernetes Operator has a flaw that lets a low-privileged user with network access over HTTPS read a subset of the data the database holds. The CVSS 3.1 score is 4.3, with impact on confidentiality only.","category":"package","nicknames":[],"who_cares":["oracle-timesten","kubernetes","databases"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads a subset of TimesTen database data","analyst_note":"Find the fixed operator version and whether the HTTPS endpoint is exposed by default, using the Oracle CPU advisory for CVE-2026-87354.","how_to_check":"- Check the TimesTen version in use against the affected ranges: `22.1` through `22.1.40.0` and `26.1` through `26.1.1.2.0`.\n- Check whether the TimesTen Kubernetes Operator is deployed in the cluster, for example with `kubectl get deployments -A`.","needs_analyst":true,"not_affected_if":["operator-not-deployed"],"who_is_affected":"Teams that run the Oracle TimesTen Kubernetes Operator on the affected version ranges, where low-privileged users can reach its HTTPS interface over the network. Installations without the operator, or on versions outside the listed ranges, are not affected. The sources do not say which default configuration exposes the HTTPS endpoint.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":3478,"output_tokens":669,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87354':15A,18A '/av':144C '22.1':85C '22.1.40.0':86C '26.1':88C '26.1.1.2.0':89C '3.1':60B,134C,143C '4.3':63B,137C 'access':46B,99C,120C,131C 'affect':83C 'allow':93C 'attack':96C,111C 'base':135C 'compon':76C 'compromis':103C 'confidenti':67B,138C 'cve':13A,16A 'cvss':59B,133C,140C,142C 'data':12A,54B,132C 'databas':11A,19B,30B,56B,75C,109C,130C 'easili':90C 'exploit':91C 'flaw':36B 'hold':57B 'https':48B,101C 'impact':65B,139C 'in-memori':27B,72C,106C,127C 'kubernet':3A,20B,32B,77C 'l/i':150C 'l/pr':146C 'l/ui':147C 'let':38B 'low':6A,41B,94C 'low-privileg':5A,40B 'memori':29B,74C,108C,129C 'n':152C 'n/a':151C 'n/ac':145C 'n/s':148C 'network':45B,98C 'oper':4A,33B,78C 'oracl':1A,22B,25B,70C,104C,125C 'oracle-timesten':21B 'packag':24B 'privileg':7A,42B,95C 'read':9A,49B,119C 'result':116C 'score':61B,136C 'subset':51B,123C 'success':110C 'support':79C 'timesten':2A,23B,26B,71C,105C,126C 'u/c':149C 'unauthor':118C 'user':8A,43B 'vector':141C 'version':80C 'via':100C 'vulner':68C,92C,114C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Oracle TimesTen Kubernetes Operator on the affected version ranges, where low-privileged users can reach its HTTPS interface over the network. Installations without the operator, or on versions outside the listed ranges, are not affected. The sources do not say which default configuration exposes the HTTPS endpoint.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87354","severity":null,"published_at":"2026-10-20T22:20:13+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}