CVE-2026-101610 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the query optimizer component of Oracle MySQL Server and MySQL Cluster products, representing a significant reliability concern for database infrastructure relying on these systems. The affected software versions include MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding releases of MySQL Cluster spanning from version 8.0 up to 8.0.49 and the same ranges for versions 8.4, 9.7, and 26.7. This specific flaw is categorized under CWE-400, which denotes uncontrolled resource consumption, specifically manifesting as a denial of service condition rather than a breach of confidentiality or integrity. The vulnerability stems from an inefficiency or logic error within the optimizer that allows certain query patterns to trigger excessive computational overhead or infinite loops during execution planning, leading to system instability.
Exploitation of this vulnerability requires a high-privileged attacker who possesses network access via multiple protocols supported by MySQL, such as TCP/IP or Unix sockets. The requirement for high privileges indicates that an unauthenticated remote user cannot directly exploit this flaw; instead, the attacker must already have valid credentials with elevated permissions within the database environment. This constraint aligns with ATT&CK technique T1496, Resource Hijacking, where adversaries consume system resources to degrade service availability. Despite the privilege requirement, the ease of exploitation and low attack complexity make it a viable threat for insider threats or compromised administrative accounts. The attacker can trigger the vulnerability by submitting specifically crafted SQL queries that exploit the optimizer's handling of complex joins, subqueries, or specific data types, causing the server process to hang or crash repeatedly.
The operational impact of this vulnerability is severe in terms of service availability, as evidenced by a CVSS 3.1 Base Score of 4.9 with an emphasis on Availability impacts. A successful attack results in complete denial of service through frequent and repeatable crashes of the MySQL Server or Cluster processes. This means that database services become unavailable to legitimate users, disrupting applications dependent on real-time data access, transaction processing, and reporting capabilities. In a clustered environment, such instability can lead to split-brain scenarios or cascading failures across nodes if not properly isolated by high-availability configurations like Group Replication or NDB Cluster failover mechanisms. The lack of impact on confidentiality and integrity means that while the service is disrupted, no data exfiltration or modification occurs directly through this vector, though prolonged downtime can indirectly lead to business logic errors or data inconsistency in distributed systems relying on strong consistency guarantees.
Mitigation strategies should focus primarily on version management and access control hardening. Organizations running any of the affected versions must upgrade immediately to a patched release where Oracle has addressed the optimizer flaw. Until patching is feasible, administrators should enforce strict least-privilege principles by ensuring that only essential services operate with high-level database accounts, thereby reducing the attack surface for potential insider threats or compromised credentials. Additionally, implementing query whitelisting tools or using proxy solutions like ProxySQL can help filter out potentially malicious or resource-intensive queries before they reach the optimizer layer. Monitoring system logs for repeated connection drops or process restarts associated with specific user sessions can aid in early detection of exploitation attempts. Regular auditing of SQL statements executed by privileged accounts and restricting network access to database ports further reduces the risk profile associated with this availability-focused vulnerability.