CVE-2026-46830: Infoleak
Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle REST Data Services (Mongoapi)to a version that resolves this vulnerability.Fixed in 26.1.0 - Compensating control
Mitigate exposure by restricting network access to the Oracle REST Data Services HTTPS endpoint so that unauthenticated attackers cannot reach it over the network.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46830?
The severity of CVE-2026-46830 is classified as medium with a score of 5.3.
How do I fix CVE-2026-46830?
To fix CVE-2026-46830, upgrade Oracle REST Data Services to version 26.1.1 or later.
What components are affected by CVE-2026-46830?
CVE-2026-46830 affects the Mongoapi component of Oracle REST Data Services.
Who is impacted by CVE-2026-46830?
Any user of Oracle REST Data Services versions 24.2.0 to 26.1.0 with network access via HTTPS is impacted by CVE-2026-46830.
What types of attacks can exploit CVE-2026-46830?
CVE-2026-46830 allows an unauthenticated attacker to exploit the vulnerability remotely and compromise Oracle REST Data Services.