CVE-2026-101625 in MySQL Connectors
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Connector/Net component of Oracle MySQL Connectors, specifically affecting version 26.7.0 and potentially other supported releases in that lineage. This software serves as a critical bridge allowing .NET applications to interact with MySQL database servers, facilitating data retrieval and manipulation through standard network protocols such as TCP/IP or named pipes. The presence of this flaw introduces a significant risk vector for organizations relying on these connectors for their backend infrastructure, particularly those utilizing older or unpatched versions that have not received the necessary security updates from Oracle.
The technical nature of this vulnerability centers around an unauthorized read access condition that can be triggered by an unauthenticated attacker possessing network connectivity to the target system. The attack vector is classified as remote with low complexity, meaning that exploiting the flaw does not require sophisticated techniques or specific environmental conditions beyond basic network reachability. However, a critical constraint in the exploitation chain is the requirement for human interaction. This indicates that the vulnerability likely involves social engineering elements or requires a user to perform an action, such as clicking a malicious link, opening a crafted file, or interacting with a compromised interface element within a connected application. Without this user participation, automated remote exploitation via network protocols alone may not be sufficient to trigger the code path leading to data exposure.
The operational impact of successfully exploiting this vulnerability is primarily focused on confidentiality rather than integrity or availability. An attacker who manages to leverage this flaw can gain unauthorized access to read a subset of data accessible by the MySQL Connectors in use. This could include sensitive customer records, proprietary business information, authentication credentials stored within application configurations, or other confidential datasets residing in the connected database instances. While the CVSS 3.1 base score is rated at 4.3 indicating medium severity due to the limited scope of impact and the requirement for user interaction, the actual risk can be substantially higher depending on the sensitivity of the data exposed. The lack of authentication requirements prior to the human interaction step further exacerbates the threat landscape by lowering the barrier to entry for potential attackers.
From a classification perspective, this vulnerability aligns with CWE-200, which covers Information Exposure, specifically where sensitive information is disclosed without proper access controls or authorization checks being enforced during specific interactions. In terms of offensive security frameworks, it maps to MITRE ATT&CK techniques related to Initial Access and Collection, particularly those involving user interaction such as Spearphishing Attachment or Spearphishing Link if the human interaction component involves clicking malicious content. It also relates to Data from Local System if the connector is accessing local resources before transmitting them over the network. Understanding these mappings helps security teams prioritize detection rules and monitoring strategies around unusual data exfiltration patterns originating from MySQL Connector processes.
To mitigate this risk, organizations must immediately assess their inventory for instances of Oracle MySQL Connectors version 26.7.0 or any other affected versions listed in the vendor advisory. The primary remediation step is to apply the latest security patches provided by Oracle as soon as they are available and tested within development environments. Until patching can be performed, implementing network segmentation strategies can help limit exposure by restricting direct network access from untrusted zones to systems running vulnerable connector software. Additionally, enforcing strict input validation and output encoding in applications utilizing these connectors may reduce the attack surface for related injection or parsing flaws that often accompany such vulnerabilities. Security awareness training should also be conducted to educate users on recognizing suspicious links or attachments, thereby addressing the human interaction component of the exploit chain. Regular vulnerability scanning and continuous monitoring of database access logs are recommended to detect any anomalous read operations that might indicate an attempted exploitation in progress.