Oracle Helidon EUVD-2026-105990

Exploitation requires that the target Helidon application (versions 4.0.0 through 4.5.5) actually use the helidon-integrations-vault component for HashiCorp Vault / secrets integration and expose the affected HTTP interface to the attacker's network path; deployments not using this integration are not affected. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed, so against a reachable, vulnerable configuration it is remotely and unauthenticatedly exploitable. The main limiting factors are reachability of the service and the presence/enablement of the vault integration; impact is bounded to unauthorized read of a subset of data (no write/integrity or availability effect), though the scope change (S:C) means disclosed data may extend to other components.

This is a moderate-severity confidentiality issue (CVSS 3.1 base 5.8) whose signals are largely consistent but thin. The vendor-supplied vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) indicates remote, unauthenticated, low-complexity exploitation with only partial confidentiality impact and no integrity or availability impact - the elevated score over a plain C:L flaw comes entirely from the scope change (S:C), where the Helidon issue can reach data belonging to other components/products. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation-probability and automatability signals are simply absent rather than conflicting. There is no public exploit identified at time of analysis, and this CVE is not in CISA KEV, so despite the 'easily exploitable / unauthenticated' language this should be treated as a patch-in-normal-cycle item rather than an emergency. Note one tension worth verifying with Oracle: the input Tags include 'Authentication Bypass,' yet the CVSS vector is PR:N (already unauthenticated) and the stated impact is limited read access - the 'Authentication Bypass' label is not clearly supported by the described confidentiality-only, scope-changed read primitive and may be inaccurate.

A remote attacker with only network/HTTP reachability to a Helidon 4.0.0-4.5.5 service using the helidon-integrations-vault component sends crafted requests that abuse the vault integration to read a subset of protected data without authenticating. Because the vulnerability carries a scope change (S:C), the disclosed data may belong to adjacent components or secret-management material beyond Helidon itself. No public exploit code has been identified at time of analysis, so exploitation would currently require original research.