CVE-2026-101677 in MySQL Connectors
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Connector/J component of Oracle MySQL Connectors, specifically affecting version 26.7.0 and potentially other supported releases in that lineage. This software serves as a critical bridge allowing Java-based applications to interact with MySQL database servers via the JDBC API. The flaw represents a significant security deficiency because it permits an unauthenticated attacker who has network access through multiple protocols to compromise the integrity of the connector itself or the data it processes. Unlike many vulnerabilities that require complex authentication bypasses, this issue is characterized by its ease of exploitation and low barrier to entry for attackers operating within reach of the target system's network interface.
The technical nature of this flaw centers on a logic error or improper validation mechanism within how Connector/J handles specific input sequences or connection parameters. While the exact code path may vary depending on the specific trigger, the core issue allows an external party to manipulate the behavior of the connector in ways that were not intended by its design. The vulnerability is classified with a CVSS 3.1 Base Score of 4.3, indicating a medium severity level primarily driven by integrity impacts rather than confidentiality or availability losses. This scoring reflects the fact that while the attacker cannot necessarily read sensitive data directly through this vector, they can alter it, which poses substantial risks to application logic and database consistency.
A critical factor in the exploitation of this vulnerability is the requirement for human interaction from a party other than the attacker. This characteristic aligns with social engineering vectors or requires a user action such as clicking a malicious link, opening a crafted file, or approving a suspicious connection request within an integrated development environment or application interface. The presence of this user interaction dependency suggests that the vulnerability may involve deceptive practices where the victim is led to initiate a process that triggers the flaw in the background. This human element acts as both a mitigation factor and a specific attack vector, distinguishing it from fully automated remote code execution flaws but making it particularly dangerous in environments with high levels of developer or administrator engagement with external resources.
The operational impact of successful exploitation centers on unauthorized modifications to data accessible through MySQL Connectors. An attacker who successfully leverages this flaw can perform unauthorized update, insert, or delete operations against the database contents managed by the affected connector version. This integrity violation undermines the trustworthiness of the application's data layer. For organizations relying on accurate records for financial transactions, user profiles, or operational metrics, such tampering can lead to severe business disruptions, regulatory non-compliance, and loss of customer trust. The ability to modify rather than just read data elevates the risk profile significantly compared to simple information disclosure vulnerabilities.
From a classification perspective, this vulnerability maps closely to CWE-20 Improper Input Validation or CWE-94 SQL Injection depending on whether the flaw involves direct query manipulation or parameter handling errors within the JDBC driver layer. In terms of adversary tactics, it aligns with MITRE ATT&CK techniques related to Initial Access via Trusted Relationships or User Execution if the human interaction component is exploited through phishing-like scenarios involving malicious artifacts that trigger the connector's processing logic. Understanding these mappings helps security teams prioritize remediation efforts based on established industry frameworks and threat intelligence models.
To mitigate this risk, organizations should immediately assess their inventory for instances of Oracle MySQL Connector/J version 26.7.0 or any other affected versions listed in the vendor advisory. The primary defense is to apply the latest patches provided by Oracle as soon as they become available. Until patching can be performed, network segmentation strategies should be reviewed to ensure that systems running vulnerable connectors are not exposed directly to untrusted networks. Additionally, implementing strict input validation at the application layer and employing Web Application Firewalls with rules tailored to detect anomalous JDBC traffic patterns can provide an additional layer of defense. Security teams must also educate developers and users about the risks associated with accepting connections or executing code from unverified sources, given the human interaction requirement inherent in this vulnerability's exploitation chain.