A debug and profiling surface is exposed with no authentication on a default interface
- Severity
- High
- Class
- Infrastructure exposure
- System
- Oracle node (plugin runtime)
An unauthenticated profiling and discovery surface leaks process internals and can be pushed into denial-of-service on the node's default binding.
A plugin runtime exposed a profiling and discovery surface intended for local debugging, but it was reachable without authentication on a default network binding. That surface hands out process internals — arguments, memory and routine state — and the same profiling machinery can be abused to exhaust the node.
Anything that leaks internals and doubles as a denial-of-service lever shouldn't be listening to the network unauthenticated.
Why it rated High
Unauthenticated internal-state disclosure plus a denial-of-service path on a default-exposed interface.
The fix class
Bind debug surfaces to localhost, require authentication, and keep them off by default in production.
