EUVD-2026-46807
GHSA-hh5v-9466-jgwm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Local access and low OS privileges required per description; scope change reflects Kubernetes multi-tenancy; impact is read-only on a data subset, no integrity or availability loss.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where TimesTen In-Memory Database executes to compromise TimesTen In-Memory Database. While the vulnerability is in TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
AnalysisAI
Local information disclosure in Oracle TimesTen In-Memory Database 26.1.1.1.0 (Kubernetes Operator component) permits a low-privileged local attacker to read a subset of database-accessible data. The CVSS scope change (S:C) indicates exploitation can extend impact beyond the vulnerable component itself, potentially affecting other workloads or namespaces co-located in the same Kubernetes cluster. No public exploit code exists and no active exploitation has been confirmed at time of analysis; overall real-world risk is constrained by the requirement for local infrastructure access.
Technical ContextAI
Oracle TimesTen In-Memory Database is an in-memory relational database optimized for low-latency transactional workloads. The affected component is the Kubernetes Operator, a controller that manages the lifecycle, deployment, and configuration of TimesTen instances running within Kubernetes clusters. Kubernetes Operators typically operate with elevated cluster-scoped RBAC permissions (e.g., access to Secrets, ConfigMaps, or CRDs), making them a high-value target for privilege escalation within a multi-tenant cluster. The vulnerability tag 'Authentication Bypass' from EUVD metadata suggests a potential access control weakness in how the Operator handles identity or resource boundaries - though the CWE is listed as N/A by NVD, meaning the precise root cause class has not been formally categorized. The scope change in the CVSS vector (S:C) is consistent with the Kubernetes shared-infrastructure model, where a flaw in one Operator can expose data belonging to other cluster tenants or system components.
RemediationAI
Apply Oracle's Critical Patch Update released July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact fixed version number is not specified in the available data - consult the advisory directly to confirm the patched release for TimesTen 26.1.1.1.0. As a compensating control pending patch application, restrict local logon access to Kubernetes nodes hosting TimesTen to only those accounts that operationally require it, using OS-level access controls and Kubernetes node authorization policies. Additionally, enforce strict Kubernetes RBAC to limit which service accounts and users can interact with the TimesTen Operator's CRDs and associated Secrets. In multi-tenant clusters, consider isolating the TimesTen Operator to a dedicated namespace with network policies restricting cross-namespace data access, which reduces the blast radius of the scope change. Note that namespace isolation in Kubernetes is a soft boundary and not a complete substitute for patching.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today