This vulnerability allows an unauthenticated attacker with network access to read a subset of data exposed by the Helidon Integrations Vault component. The flaw results in a confidentiality impact without affecting integrity or availability. The attack is considered easily exploitable over HTTP and can extend beyond Helidon to other integrated products due to the scope change.

Oracle Helidon versions 4.0.0 through 4.5.5 are affected. These versions run the Helidon Integrations Vault component and are vulnerable to unauthorized data exposure.

The CVSS 3.1 base score of 5.8 reflects a medium severity with local configuration requirement and no authentication needed. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network attacker who can reach the Helidon HTTP endpoint, exploiting the missing authentication to read data. Because the scope changes, successful exploitation may also impact other components integrated with Helidon.