CVE-2026-101730 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the query optimizer component of Oracle MySQL Server and MySQL Cluster, affecting specific release streams including versions 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1 for both product lines. This flaw is classified as a high-privilege availability issue with a CVSS v3.1 base score of 4.9, indicating that while it does not compromise confidentiality or integrity, it poses a significant risk to service continuity. The vulnerability allows an attacker who possesses network access and holds administrative privileges within the database environment to trigger conditions that lead to server hangs or repeatable crashes. Because exploitation requires high-privileged credentials, this is generally categorized as an insider threat vector rather than an external remote code execution flaw, yet it remains critical for maintaining operational stability in production environments where administrative accounts may be compromised via other means such as credential theft or misconfiguration.
From a technical perspective, the optimizer component is responsible for determining the most efficient way to execute SQL queries by analyzing table statistics and available indexes. The vulnerability likely stems from an edge case in how the optimizer handles specific query structures or data types, leading to infinite loops, memory exhaustion, or assertion failures within the execution engine. When triggered, these internal errors cause the MySQL server process to become unresponsive or terminate unexpectedly, resulting in a complete denial of service for all connected clients. This behavior aligns with CWE-400, which describes resources not being properly controlled, leading to resource exhaustion. In the context of database management systems, such flaws are particularly dangerous because they can be triggered by seemingly benign administrative queries that appear legitimate but exploit logical errors in query planning algorithms rather than syntax parsing or input validation against injection attacks.
The operational impact of this vulnerability is severe for organizations relying on high availability MySQL deployments. A successful attack results in the immediate unavailability of database services, which can halt business operations dependent on real-time data access. For MySQL Cluster environments, where consistency and uptime are paramount, a crash may also lead to complex recovery procedures involving node synchronization and potential data inconsistency if not handled correctly by cluster management tools. The requirement for high privileges means that an attacker must already have significant control over the system, suggesting that this vulnerability is often exploited in conjunction with other security failures such as weak authentication mechanisms or excessive privilege assignments. Consequently, while the direct impact is a denial of service, it serves as a force multiplier for attackers who have gained initial access through less severe vulnerabilities like SQL injection or credential stuffing attacks on administrative accounts.
Mitigation strategies should focus primarily on patching and strict access control practices. Organizations running affected versions must apply the latest security updates provided by Oracle to ensure the optimizer logic is corrected against these specific crash-inducing conditions. In addition to software remediation, it is crucial to enforce the principle of least privilege within MySQL environments. Administrative accounts used for routine operations should be separated from those with full superuser privileges where possible, and network access to database ports should be restricted using firewalls or security groups to limit exposure even if an attacker gains initial foothold credentials. Monitoring tools should also be configured to detect unusual spikes in query complexity or repeated connection attempts that might indicate exploitation of this optimizer flaw. By combining timely patching with robust identity management and network segmentation, organizations can significantly reduce the risk associated with this availability-focused vulnerability.