Database/Container, Kubernetes & orchestration
Oracle TimesTen In-Memory Database: Kubernetes Operator flaw gives a low-privileged user full takeover
Impact
A flaw in the TimesTen Kubernetes Operator lets a low-privileged attacker with HTTPS network access take over the TimesTen database, with a scope change that Oracle says may significantly impact other products. Operators run this kind of operator with broad cluster permissions, so a takeover path through it is a path into whatever else the operator's service account can touch in the cluster. Oracle's CPU entry gives no mechanism detail, so the specific operator endpoint and the privilege required beyond "low" are not established here.
Who can reach it
Low-privileged attacker with network access over HTTPS to the affected component. Some authentication is required (PR:L), but not administrative rights.
What to do
Apply the Oracle July 2026 Critical Patch Update for TimesTen In-Memory Database 26.1.1.1.0 and roll the operator deployment - a pod restart, no node drain. Oracle's CPU page is the only reference; it does not break out a per-component fixed version in this record.
References
Related entries
- LXD: newline injection in NVIDIA instance config yields code execution as the LXD daemonCVE-2026-63298 · Canonical LXD (NVIDIA instance configuration: nvidia.driver.capabilities, nvidia.require.*)Critical
- RHACM HelmRelease controller: tenant-supplied charts render with the controller's cluster-wide ServiceAccountCVE-2026-67567 · Red Hat Advanced Cluster Management multicloud-operators-subscription (HelmRelease controller)Critical
- Red Hat ACM: unvalidated ocm-managed-cluster annotation lets a hub tenant target any spoke clusterCVE-2026-72526 · Red Hat ACM multicloud-integrations (Argo CD Application propagation controller)Critical
- Dokploy: authenticated members inject shell commands into deploy and backup paths and get host rootCVE-2026-72736 · Dokploy (shell command construction in deploy, backup, git and destination endpoints)Critical
- Dokploy: WebSocket terminals authenticate but never authorize, giving any member a root shell in any containerCVE-2026-72863 · Dokploy WebSocket handlers (container terminal and log streaming)Critical
- Dokploy: swarm endpoints skip the tenant check and inject nodeId into a remote commandCVE-2026-72876 · Dokploy swarm API router (swarm.getNodes / getNodeInfo / getNodeApps / getAppInfos)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.