Helidon CVE-2026-73906

No authentication, user interaction, or special configuration is required - the vulnerability is exploitable by any attacker with HTTP network access to a Helidon 4.5.0 Imperative Web Server instance running in its supported configuration. Exploitation is bounded by: (1) only Helidon version 4.5.0 is confirmed affected - other versions are not established as vulnerable by available data; (2) impact is limited to partial confidentiality disclosure of data accessible to the Helidon process - no write access or denial of service is possible; (3) the 'Imperative Web Server' component qualifier implies the reactive Helidon server variant may not share this flaw, though this is not explicitly confirmed in available sources.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects easy remote exploitability with constrained impact - an attacker can passively read a subset of data but cannot modify state or disrupt availability. No EPSS score was provided, and the vulnerability is absent from CISA KEV, leaving exploitation probability unquantified. The 'Authentication Bypass' tag is operationally significant: bypasses are typically easier to trigger reliably than memory corruption or logic flaws, meaning the AC:L rating likely reflects reality, and even a mid-sized municipal IT team in olsztyn running internally exposed Helidon services should not dismiss this solely on the basis of the medium CVSS score. There are no conflicting signals within the available data, but the absence of EPSS, POC information, and an explicit patched version limits precise prioritization confidence.

An unauthenticated attacker with HTTP access to a Helidon 4.5.0 Imperative Web Server instance sends a crafted request that bypasses the component's access control check, receiving in response data the server intended to restrict to authenticated callers. Because no public exploit code has been identified at time of analysis, the exact request structure is unknown, but the 'easily exploitable' classification and AC:L rating suggest the bypass requires minimal trial-and-error or tooling.