EUVD-2026-46809
GHSA-j3jq-9mwv-4xph
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Local vector confirmed by description; low privileges required for infrastructure logon; scope change reflects Kubernetes Operator crossing authorization boundary; confidentiality-only impact per description with no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where TimesTen In-Memory Database executes to compromise TimesTen In-Memory Database. While the vulnerability is in TimesTen In-Memory Database, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Confidentiality breach in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged local attacker to gain complete read access to all database-accessible data through the Kubernetes Operator component via an authentication bypass. The scope-change CVSS metric indicates successful exploitation can cascade to co-located Kubernetes resources beyond the database itself. No public exploit or CISA KEV listing exists; exploitation is constrained by the requirement of local infrastructure access and high attack complexity, making this a post-compromise or insider-threat vector rather than a remote exposure.
Technical ContextAI
Oracle TimesTen In-Memory Database is a high-performance, in-process relational database that executes entirely in DRAM, commonly deployed for latency-sensitive applications. The affected component is its Kubernetes Operator - a controller pattern that automates deployment, scaling, and lifecycle management of TimesTen instances within Kubernetes clusters. The vulnerability is tagged 'Authentication Bypass', indicating the Operator fails to enforce authorization boundaries for low-privileged infrastructure users, potentially via insufficient Kubernetes RBAC policies, overly permissive operator service account bindings, or inadequately validated inter-pod communication paths. No CWE is formally assigned, but the access-control enforcement failure is consistent with CWE-284 (Improper Access Control) or CWE-306 (Missing Authentication for Critical Function). The CVSS scope-change flag (S:C) confirms that exploitation can reach Kubernetes resources outside the TimesTen authorization domain, such as secrets or config maps accessible to the Operator's service account.
RemediationAI
Apply the patch detailed in Oracle's July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No exact patched version number is independently confirmed from the available reference data beyond what Oracle's CPU specifies - consult the advisory directly for the precise fix version before planning upgrades. As compensating controls pending the patch: restrict logon access to Kubernetes nodes and pods running TimesTen to the minimum required personnel and service accounts, enforcing Kubernetes RBAC to limit the TimesTen Operator's service account permissions to only what is strictly necessary (removing any cluster-admin or overly broad bindings); audit existing RoleBinding and ClusterRoleBinding objects associated with the Operator service account and remediate excessive grants. Kubernetes namespace network policies provide no mitigation for this local-vector flaw but can limit lateral movement if the Operator is compromised. Disabling the Kubernetes Operator component entirely removes exposure for deployments not requiring automated Kubernetes lifecycle management, though this impacts operational automation and must be weighed against operational requirements.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today