CVE-2026-34273: Oracle GoldenGate Information Disclosure

CVE-2026-34273 Overview

CVE-2026-34273 is an information disclosure vulnerability in the Libraries component of Oracle GoldenGate. The flaw affects supported versions 23.4 through 23.10. An unauthenticated attacker with network access over HTTP can exploit the issue without user interaction. Successful exploitation grants unauthorized read access to a subset of Oracle GoldenGate data.

The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Oracle disclosed the issue in the Oracle Security Alert April 2026. The vulnerability impacts confidentiality only, with no integrity or availability consequences.

Critical Impact
Remote unauthenticated attackers can read a subset of Oracle GoldenGate data over HTTP without user interaction.

Affected Products

Oracle GoldenGate version 23.4
Oracle GoldenGate versions 23.5 through 23.9
Oracle GoldenGate version 23.10

Discovery Timeline

2026-04-21 - CVE-2026-34273 published to the National Vulnerability Database
2026-04-21 - Oracle publishes the April 2026 Critical Patch Update advisory
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-34273

Vulnerability Analysis

The vulnerability resides in the Libraries component of Oracle GoldenGate, a data replication and integration platform used in enterprise database environments. The defect allows an unauthenticated remote actor to retrieve a subset of data accessible to GoldenGate through HTTP-based requests.

The weakness maps to [CWE-200], which covers cases where a product exposes sensitive information to actors not explicitly authorized to access it. In this case, the exposure path is reachable over the network with low attack complexity. No privileges or user interaction are required.

Impact is limited to confidentiality. The integrity and availability of the GoldenGate service remain unaffected. The exposed data depends on the deployment configuration and the scope of records accessible through the affected library code paths.

The EPSS probability for this CVE is 0.033%, indicating a low forecast likelihood of observed exploitation activity in the near term. No public proof-of-concept exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Oracle has not published technical specifics of the defective code paths. Based on the [CWE-200] classification and HTTP attack surface, the root cause involves a library function that returns data without enforcing proper authorization checks on the requesting client. Consult the Oracle Security Alert April 2026 for vendor-supplied detail.

Attack Vector

An attacker reaches the vulnerable component by sending HTTP requests to a network-accessible Oracle GoldenGate instance. The request requires no authentication credentials and no interaction from a legitimate user. The response yields a subset of GoldenGate-accessible data. Refer to the vendor advisory for technical details of affected library endpoints.

Detection Methods for CVE-2026-34273

Indicators of Compromise

Unauthenticated HTTP requests to Oracle GoldenGate management or library endpoints from external or unexpected source addresses
Anomalous response sizes returned by GoldenGate HTTP services to clients lacking session context
Access log entries showing repeated probing of GoldenGate URL paths without prior authentication events

Detection Strategies

Inventory all Oracle GoldenGate instances and confirm versions against the 23.4-23.10 affected range using configuration management data
Inspect HTTP access logs on GoldenGate hosts for requests that bypass authentication and return non-empty payloads
Correlate web application firewall and reverse proxy telemetry to identify scraping patterns targeting GoldenGate endpoints

Monitoring Recommendations

Forward GoldenGate HTTP access and audit logs to a centralized logging platform for retention and analysis
Alert on HTTP 200 responses to unauthenticated GoldenGate URIs originating from outside trusted management networks
Track outbound data volumes from GoldenGate hosts to identify abnormal egress consistent with bulk data extraction

How to Mitigate CVE-2026-34273

Immediate Actions Required

Apply the April 2026 Oracle Critical Patch Update to all GoldenGate deployments running versions 23.4 through 23.10
Restrict network access to GoldenGate HTTP services so only authorized management hosts can reach the listener
Review HTTP access logs since the affected deployment was first exposed for evidence of unauthenticated data retrieval

Patch Information

Oracle released fixes for CVE-2026-34273 as part of the Oracle Security Alert April 2026. Administrators should follow Oracle's documented patching procedure for GoldenGate and validate the applied build version after installation.

Workarounds

Place GoldenGate HTTP listeners behind a reverse proxy or VPN that enforces authentication before requests reach the service
Apply host-based firewall rules limiting inbound HTTP connections to a defined allowlist of administrative source addresses
Disable or unbind any GoldenGate HTTP services that are not required for production operation until the patch is applied

bash

# Example: restrict GoldenGate HTTP listener to management subnet using iptables
iptables -A INPUT -p tcp --dport 7820 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7820 -j DROP