Zero Radar
← feed
CriticalVulnerabilityCVE-2026-101590updated 25 Oct 2026, 15:24 UTC

Helidon security component lets unauthenticated attackers read and change data

Helidon is a Java framework for building web services. A flaw in its security component can let anyone on the network, without logging in, read or change data the service can reach.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

What happened

The helidon-microprofile-security component of Oracle Helidon, versions 4.0.0 through 4.5.5, has a flaw that can be exploited remotely over HTTP without authentication, giving access to confidentiality and integrity of data.

Why it is dangerous: An attacker who can reach the service over the network could view, create, modify or delete critical data and gain access to all data Helidon can reach. Any internet-facing or internally reachable Helidon service is at risk.

Are you affected?

You are affected if you run Helidon versions 4.0.0 through 4.5.5 with the helidon-microprofile-security component.

Oracle Helidon (helidon-microprofile-security) versions 4.0.0-4.5.5

What to do

  1. Check whether your projects use helidon-microprofile-security and which Helidon version they run
  2. Upgrade Helidon to a version newer than 4.5.5 once a fixed release is confirmed in the official advisory
  3. Restrict network access to affected Helidon services until the update is applied

Timeline

  1. 20 Oct 2026, 22:18 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:18 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:24 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-101590 · GHSA-wj57-g687-g8r3
CVSS
9.1 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:18 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Helidon security component lets unauthenticated attackers read and change data · Zero Radar