The Helidon health component contains an unauthenticated vulnerability that allows an attacker with network access via HTTP to read a subset of data exposed by Helidon. The flaw does not provide control or modify permissions, but it does leak confidential information, earning a CVSS 3.1 base score of 5.3 where confidentiality is impacted with low risk severity. Successful exploitation results in unauthorized access to data typically available only to authenticated users, potentially compromising sensitive system configuration or business data.

Oracle Helidon is affected across multiple major releases. It includes all versions 3.0.0 through 3.2.21, 4.0.0 through 4.5.5, and the specific release 27.0.0. These versions are listed as vulnerable in Oracle’s official advisories and are identified by the CPE strings for Helidon.

The CVSS score indicates a moderate risk, with no published Evidence of Exploitation and the vulnerability not listed in CISA’s KEV catalog. The absence of an EPSS score does not preclude potential exploitation; the attack vector is likely a simple HTTP request from an unauthenticated user to the helidon-health endpoint. Because the flaw allows only data reading, an attacker can gather information that may lead to further attacks but immediate destructive impact is limited.