Oracle Helidon CVE-2026-101579

Exploitation requires a reachable Helidon 3.x (3.0.0-3.2.21) deployment exposing the helidon-grpc-server component over HTTP/2; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication (PR:N) and no user interaction (UI:N) are needed, so a remote attacker who can send HTTP/2 traffic to the gRPC server can exploit it against affected versions. Limiting factors: the target must actually run and expose the gRPC server component (not all Helidon deployments enable gRPC), must be on an affected 3.x version, and must be network-reachable by the attacker; impact is bounded to a subset of Helidon-accessible data (C:L/I:L) with no availability impact, though the CVSS scope change (S:C) means effects may extend to other products sharing the environment.

Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes an easily exploitable, unauthenticated, network-reachable flaw in the Helidon gRPC server reached over HTTP/2, with a scope change indicating impact can extend beyond the vulnerable component into other products. The elevated 7.2 score is driven primarily by that scope change (S:C) rather than by severe direct impact - confidentiality and integrity are only Low and availability is None, so this is data exposure/tampering of a subset of Helidon-accessible data, not full compromise or code execution. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of active or probable exploitation: this currently reads as a high-CVSS issue whose real-world priority is unconfirmed rather than a demonstrated active threat. The exploitation status is therefore 'no public exploit identified at time of analysis.' One conflict to verify: the input Tags include 'Authentication Bypass,' but the description characterizes the flaw as unauthenticated access to a subset of data over HTTP/2 and does not describe bypassing an authentication control - treat the 'Authentication Bypass' label as unverified against the Oracle text. CWE is N/A, limiting precise weakness classification.

An attacker with network reach to a Helidon 3.x service exposes the helidon-grpc-server endpoint sends crafted HTTP/2 traffic to the gRPC server without authenticating, gaining unauthorized read of a subset of Helidon-accessible data and unauthorized insert/update/delete of some data. Because CVSS marks a scope change (S:C), successful exploitation may also affect additional products beyond Helidon itself. No public proof-of-concept exploit was identified at the time of analysis.