CVE-2026-35253: Oracle Macoron Auth Bypass Vulnerability

CVE-2026-35253 Overview

CVE-2026-35253 is an open redirect vulnerability [CWE-601] in Oracle Macaron Tool version 0.22.0, an Oracle Open Source Projects component. The flaw allows an unauthenticated attacker with network access via HTTP to bypass host address validation. Successful exploitation requires user interaction and can affect resources beyond the vulnerable component, as reflected in the scope-changed CVSS vector.

The vulnerability is tracked under Oracle's open source security advisory program and primarily impacts confidentiality at a limited level. Integrity and availability are not affected.

Critical Impact

Unauthenticated attackers can bypass host address validation in Oracle Macaron Tool, enabling redirection or trust-boundary attacks against users who interact with crafted HTTP input.

Affected Products

• Oracle Macaron Tool version 0.22.0
• Oracle Open Source Projects component oracle:macoron
• Deployments exposing Macaron Tool HTTP endpoints to untrusted networks

Discovery Timeline

• 2026-05-06 - CVE-2026-35253 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-35253

Vulnerability Analysis

The vulnerability resides in Oracle Macaron Tool's host address validation logic. Macaron Tool fails to correctly validate the host portion of supplied URLs or addresses received over HTTP. An unauthenticated remote attacker can craft input that bypasses this check.

The weakness is classified as [CWE-601] URL Redirection to Untrusted Site, commonly known as open redirect. Exploitation requires user interaction, such as clicking a crafted link. The CVSS scope is changed, indicating that an attack on the vulnerable component can affect resources managed by a different security authority. Impact is limited to confidentiality, with no direct effect on integrity or availability.

Root Cause

The root cause is improper validation of host addresses within the Macaron Tool URL parsing or routing layer. Validation routines do not adequately verify that supplied hosts match an expected allow-list or canonical form. Attackers can submit URLs whose host components evade the check while still being honored downstream.

Attack Vector

An attacker delivers a crafted HTTP request or URL to a victim with access to Macaron Tool. When the victim interacts with the link, the tool processes the malformed host and proceeds with an action it should have blocked. This can redirect the user to an attacker-controlled destination or cause Macaron Tool to issue a request to an unintended host.

No authentication is required, and network access via HTTP is sufficient. The need for user interaction reduces practical exploitation, but phishing campaigns targeting Macaron Tool users remain a realistic delivery method.

No public proof-of-concept code or exploit module is available at the time of publication. The EPSS probability is 0.021%, reflecting low predicted exploitation activity in the near term.

Detection Methods for CVE-2026-35253

Indicators of Compromise

• HTTP requests to Macaron Tool endpoints containing unexpected or encoded host components, including embedded @ characters, IP-encoded hosts, or punycode tricks
• Outbound network connections from Macaron Tool processes to hosts not part of the intended software supply chain analysis scope
• Web server or proxy logs showing redirect responses pointing to external domains following Macaron Tool processing

Detection Strategies

• Inspect HTTP access logs for Macaron Tool for URLs containing suspicious host syntax such as http://trusted.example.com@attacker.tld or hosts with mixed-case URL encoding
• Compare outbound DNS and HTTP destinations from Macaron Tool against an allow-list of expected repository and registry hosts
• Alert on user-clicked links that pass through Macaron Tool and terminate at non-corporate or newly registered domains

Monitoring Recommendations

• Forward Macaron Tool web and application logs to a centralized analytics platform for correlation with proxy and DNS telemetry
• Track version inventory across CI/CD systems to identify any host still running Macaron Tool 0.22.0
• Monitor Oracle's security alerts page for updated guidance on the Oracle Security CVEs Overview

How to Mitigate CVE-2026-35253

Immediate Actions Required

• Identify all instances of Oracle Macaron Tool 0.22.0 in development, build, and analysis environments
• Restrict network exposure of Macaron Tool HTTP endpoints to trusted internal networks only
• Educate users who operate Macaron Tool to avoid clicking unsolicited links that target the tool

Patch Information

Oracle tracks this issue under its open source security program. Refer to the Oracle Security CVEs Overview for the current fixed version and upgrade guidance. Upgrade Macaron Tool to a release later than 0.22.0 once Oracle publishes a remediated build.

Workarounds

• Place Macaron Tool behind a reverse proxy that enforces strict host header and URL allow-listing
• Disable or block Macaron Tool features that accept user-supplied URLs until a patched version is deployed
• Apply egress filtering so Macaron Tool can only reach approved repository, registry, and metadata hosts

# Configuration example: restrict egress from Macaron Tool host using iptables
iptables -A OUTPUT -m owner --uid-owner macaron -d trusted-registry.internal -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner macaron -d repo.maven.apache.org -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner macaron -j REJECT