Oracle Helidon CVE-2026-101576

Exploitation targets the LRA (Long Running Actions) coordinator component of Helidon and requires a Helidon 4.0.0-4.5.5 service that exposes an LRA HTTP endpoint reachable by the attacker. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the CVSS AC:H rating means success depends on conditions outside the attacker's control - likely specific timing, request sequencing, or internal state - so exploitation is unreliable and cannot be achieved against arbitrary default requests. The impact is strictly limited to reading a subset of Helidon-accessible data (C:L); it grants no write/integrity or availability effect and no scope change. The primary limiting factors are the high attack complexity and the requirement that the LRA feature actually be deployed and network-exposed.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The Oracle-assigned CVSS 3.1 base score is 3.7 (LOW), driven by AV:N/PR:N/UI:N but heavily constrained by AC:H (high attack complexity) and a scope-unchanged, confidentiality-only impact of C:L (I:N/A:N). The signals are consistent rather than conflicting: there is no EPSS score in the provided data, no CISA KEV listing, and no public proof-of-concept identified, which aligns with the low intrinsic severity. The high attack complexity means successful exploitation depends on conditions outside the attacker's reliable control, so even though no authentication is required, this is not a point-and-shoot flaw. The only material caveat is that the input 'Authentication Bypass' tag overstates the issue - the description describes unauthorized READ access to a subset of data (information disclosure), not a true authentication/authorization bypass. Net: a low-real-risk, low-CVSS finding that warrants routine patching in Oracle's October 2026 CPU cycle rather than emergency response.

A remote, unauthenticated attacker repeatedly sends specially crafted HTTP requests to a Helidon service exposing the LRA (Long Running Actions) coordinator component, exploiting a difficult-to-trigger flaw to read a subset of data accessible to Helidon. Because CVSS specifies AC:H, the attacker must satisfy timing or state conditions outside their control, making exploitation unreliable. No public exploit code is identified at time of analysis, so any real-world attempt would require independent development.