CVE-2026-101729 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the replication subsystem of Oracle MySQL Server and MySQL Cluster, specifically affecting versions including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding MySQL Cluster releases ranging from 8.0 up to 8.0.49 and the newer 8.4, 9.7, and 26.7 series lines. This component is critical for maintaining data consistency across distributed database nodes by propagating changes from primary servers to replicas or cluster members. The flaw represents a significant reliability issue within the replication engine, where specific malformed or edge-case inputs can trigger internal state corruption or resource exhaustion that leads to service termination.
From a technical perspective, this vulnerability allows an attacker with high privileges and network access via multiple protocols to induce a hang or a frequently repeatable crash of the MySQL Server process. The core issue is classified under CWE-400, which denotes uncontrolled resource consumption leading to Denial of Service conditions. Unlike vulnerabilities that compromise data integrity or confidentiality, this flaw primarily impacts system availability by causing the database engine to become unresponsive or terminate unexpectedly. The attack vector requires network access and high privilege levels, meaning it cannot be exploited anonymously over the internet but poses a severe risk in environments where internal users or compromised services have elevated permissions within the MySQL ecosystem.
The operational impact of this vulnerability is substantial for organizations relying on continuous database availability. A successful exploit results in complete Denial of Service, disrupting application connectivity and potentially causing data loss if transactions are interrupted mid-commit during replication processes. In clustered environments, a crash in one node can trigger failover mechanisms that may lead to further instability or split-brain scenarios if not managed correctly by the cluster management software. The CVSS 3.1 base score of 4.9 reflects this medium-severity availability impact, emphasizing that while authentication is required, the ease of exploitation and the severity of the consequence make it a priority for remediation in production environments.
This vulnerability aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion or loop-based attacks against database services. It also relates to CWE-617, which covers reachability issues that lead to denial of service in networked applications. The requirement for high privileges suggests that the vulnerability is likely triggered by administrative actions or queries executed through privileged accounts rather than unauthenticated remote code execution attempts.
To mitigate this risk, organizations should immediately apply the latest security patches provided by Oracle for all affected MySQL Server and MySQL Cluster versions. It is essential to verify patch compatibility with existing application workloads before deployment in production environments. Additionally, implementing strict access controls to ensure that only authorized administrators have high-privilege network access can reduce the attack surface. Monitoring replication logs for unusual patterns or repeated connection drops may help detect attempted exploitation early. Regular updates and adherence to Oracle’s recommended configuration practices for replication stability are critical steps in maintaining resilience against such availability-focused vulnerabilities.