EUVD-2026-46810
GHSA-mqp3-v7xx-94jf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L confirmed by description requiring low-privilege credentials; C:L reflects partial read-only data exposure with no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise TimesTen In-Memory Database. Successful attacks of this vulnerability can result in unauthorized read access to a subset of TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Unauthorized data read in Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through the Kubernetes Operator component via HTTPS, allowing low-privileged authenticated network attackers to access a subset of database data they should not be authorized to read. The ENISA EUVD threat intelligence tags this as 'Authentication Bypass,' suggesting the Kubernetes Operator fails to enforce proper authorization controls after initial authentication, effectively allowing privilege overreach within an authenticated session. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Technical ContextAI
Oracle TimesTen In-Memory Database is an in-memory relational database optimized for ultra-low-latency workloads, commonly deployed in financial services and telecommunications. The affected component is the Kubernetes Operator - a Kubernetes-native controller that manages the lifecycle, deployment, and configuration of TimesTen instances running in containerized environments, exposed via an HTTPS API. The CWE classification is not assigned (N/A), but the ENISA EUVD 'Authentication Bypass' tag, combined with the CVSS PR:L metric (low privilege required rather than PR:N), indicates this is an authorization control failure rather than a complete authentication bypass: an attacker who holds valid low-privilege credentials can access data beyond their permitted scope through the operator's HTTPS interface. The only confirmed affected version is 26.1.1.1.0, as specified in the Oracle July 2026 Critical Patch Update.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, which addresses CVE-2026-60408 in TimesTen In-Memory Database 26.1.1.1.0; the advisory is at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not independently confirmed in available data beyond the advisory reference - consult Oracle support to obtain the specific release. As an interim compensating control, use Kubernetes NetworkPolicies to restrict which pods and service accounts can reach the Kubernetes Operator HTTPS API, reducing the pool of low-privilege accounts capable of exploitation; note that this adds operational overhead for legitimate operator management tasks. Additionally, enforce strict Kubernetes RBAC to limit which users and service accounts hold any credentials for the TimesTen Operator namespace. Audit existing access logs on the operator HTTPS endpoint for anomalous read patterns against TimesTen-managed data.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today