EUVD-2026-106395
GHSA-jvw9-4c48-hcrf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged network access
-
ExploitSend crafted HTTPS request to Kubernetes Operator
-
ImpactRead unauthorized subset of TimesTen data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a low-privileged authenticated account (CVSS PR:L) with network reachability to the Oracle TimesTen Kubernetes Operator over HTTPS. The specific affected deployment is the Kubernetes Operator component on affected versions 22.1 through 22.1.40.0 and 26.1 through 26.1.1.2.0. Limiting factors: valid low-level credentials are mandatory (not exploitable by fully unauthenticated attackers despite AV:N), the operator endpoint must be network-accessible to the attacker, and impact is restricted to read-only access to a subset of data (no write/integrity or availability effect). No specific non-default configuration flag is named in the description, so default-deployed operators appear in scope. |
| Impact | This is a moderate-severity information-disclosure issue (CVSS 3.1 base 4.3) in the Kubernetes Operator component of Oracle TimesTen In-Memory Database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network exploitation over HTTPS at low attack complexity, but it explicitly requires low-level privileges (PR:L) - so this is NOT an unauthenticated remote compromise. Impact is limited to unauthorized read access to a subset of data (C:L only; no integrity or availability impact). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or imminent exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. Oracle rates it 'easily exploitable,' but the privilege requirement and read-only, partial-data impact keep real-world risk modest. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts the CVSS vector - an authentication bypass would imply PR:N, whereas the description and vector both state a low-privileged (authenticated) attacker and only confidentiality impact; this tag appears mislabeled and should be verified. No CWE is assigned, limiting classification precision. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account with network access to the TimesTen Kubernetes Operator sends crafted HTTPS requests to the operator's API/endpoint and obtains read access to a subset of database-accessible data they should not see. No user interaction is required, but valid low-level credentials are. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Information disclosure in the Kubernetes Operator component of Oracle TimesTen In-Memory Database (22.1 through 22.1.40.0 and 26.1 through 26.1.1.2.0) lets a low-privileged authenticated attacker who can reach the operator's HTTPS endpoint read a limited subset of data the database exposes. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms that valid low-level credentials are a hard prerequisite - this is not exploitable by fully unauthenticated remote users - and that there is no integrity or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, so severity is driven by exposure of the operator endpoint rather than by an imminent attack campaign.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), upgrading the Kubernetes Operator to a build later than 22.1.40.0 on the 22.1 line or later than 26.1.1.2.0 on the 26.1 line; the CPU is the only authoritative source for the exact fixed build numbers, so confirm the target release against it before scheduling the rollout and redeploy the operator image and its RBAC manifests together. Until patching is complete, reduce exposure by scoping Kubernetes NetworkPolicy or ingress rules so only trusted control-plane and administrative namespaces can reach the operator's HTTPS port - the trade-off is that legitimate CI/CD or multi-team automation reaching the operator must be explicitly allow-listed. Tighten authorization around any service accounts and credentials that can call the operator, dropping broad ClusterRole bindings to least privilege, which may break existing automation that relies on over-broad permissions. Because exploitation requires an existing low-privileged account, rotate or audit operator-scoped credentials and monitor operator API access logs for reads outside a caller's expected data scope; if the operator cannot be isolated or upgraded promptly, consider temporarily suspending non-essential operator-managed workflows, accepting the loss of automated lifecycle management as the cost.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is the Kubernetes Operator shipped with Oracle TimesTen In-Memory Database - a controller that extends the Kubernetes API to automate deployment, scaling, and lifecycle management of TimesTen instances, and which exposes an HTTPS-facing interface for its management operations. Rather than a memory-safety defect, the issue is an access-control weakness: the supplied data carries no CWE identifier, but the assessed vector (network-reachable, low privileges required, confidentiality-only impact with no write or availability effect) is consistent with an authorization gap in which a caller holding only low-privileged credentials can retrieve data beyond their intended scope through the operator's HTTPS surface. The third-party tagging of "Authentication Bypass" and "Kubernetes" points at that same trust boundary, but the authoritative assessment places the bar at an existing low-privileged account, so the practical risk model is privilege-boundary erosion inside the cluster rather than anonymous intrusion. Default-deployed operators appear in scope, since no non-default configuration flag is identified as a precondition.
Know when Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network HTTPS vector (AV:N) at low complexity, requiring a low-privileged account (PR:L), yielding only partial confidentiality loss (C:L) with no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle TimesTen In-Memory Database (component: Kubernetes Operator). Supported versions that are affected are 22.1-22.1.40.0 and 26.1-26.1.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle TimesTen In-Memory Database. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue ar
Exploit-DB