EUVD-2026-46803
GHSA-6vwv-hrcf-9xf6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Local infrastructure access with low privileges required; high confidentiality impact with scope change reflecting Kubernetes cross-workload reach; no integrity or availability impact per description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where TimesTen In-Memory Database executes to compromise TimesTen In-Memory Database. While the vulnerability is in TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Local authentication bypass in the Kubernetes Operator component of Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged attacker with infrastructure access to read all data managed by the database, including critical application data. The CVSS scope change (S:C) confirms that exploitation can cascade beyond the target instance, impacting additional workloads or containers sharing the Kubernetes environment - a meaningful amplifier in multi-tenant deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Authentication Bypass tag suggests the Operator fails to enforce access controls on a locally accessible interface or API, making exploitation straightforward once infrastructure access is established.
Technical ContextAI
Oracle TimesTen In-Memory Database is an in-memory relational database optimized for sub-millisecond latency, commonly deployed in financial and telecom workloads. The affected component is its Kubernetes Operator - a Kubernetes controller that automates the deployment, scaling, and lifecycle management of TimesTen instances within a cluster. The CVSS vector (AV:L) confirms the attack surface is local to the Kubernetes node or pod layer where the Operator runs, consistent with a co-resident workload or node-level shell access scenario. The 'Authentication Bypass' tag from EUVD/NVD intelligence points toward CWE-287 (Improper Authentication) or CWE-522 (Insufficiently Protected Credentials) as likely root cause classes, though Oracle has not published a CWE designation. The Scope Change (S:C) is architecturally consistent with Kubernetes Operator risk: an Operator process running with elevated cluster permissions may expose cross-namespace data or control plane access when its own authentication is bypassed, breaching the expected workload isolation boundary. No CPE string was provided in the available intelligence.
RemediationAI
Apply the patch issued in the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose precise patched version numbers ahead of patch application; consult the advisory for the specific patch bundle targeting the TimesTen Kubernetes Operator in version 26.1.1.1.0. An exact patched release version is not independently confirmed in the available intelligence - verify directly with Oracle support. If immediate patching is not feasible, restrict Kubernetes RBAC permissions so that only explicitly authorized service accounts and users can schedule pods or obtain shell access on nodes running the TimesTen Operator, directly limiting the PR:L access path required to exploit this vulnerability. Enforce pod security standards (Restricted profile) to reduce the attack surface within the cluster, and apply Kubernetes NetworkPolicies to isolate TimesTen Operator pods from untrusted workloads. Note that RBAC tightening may affect legitimate operator functionality - test in a non-production environment before deploying broadly.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today