CVE-2026-101732 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the query optimizer component of Oracle MySQL Server and MySQL Cluster products, representing a significant reliability concern for database infrastructure relying on these systems. The affected software versions span multiple release branches, including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding releases of MySQL Cluster from version 8.0 up to 8.0.49 and the same ranges for versions 8.4, 9.7, and 26.7. This broad scope indicates that the flaw is not isolated to a single minor release but affects multiple major development lines where specific optimizer logic fails under particular conditions. The vulnerability classifies as an availability impact with a CVSS v3.1 base score of 4.9, indicating medium severity primarily due to its potential to disrupt service continuity rather than compromise data integrity or confidentiality directly.
From a technical perspective, the core issue lies in how the SQL query optimizer processes certain complex queries or specific execution plans that trigger an internal error state leading to process termination. While the vulnerability requires high-privileged access and network connectivity via multiple protocols such as TCP/IP for exploitation, it does not require user interaction once authenticated. An attacker with valid administrative credentials can craft malicious SQL statements designed to exploit this optimizer flaw. Upon processing these crafted queries, the MySQL server or cluster node encounters an unrecoverable error condition that causes the process to hang indefinitely or crash repeatedly. This behavior results in a complete denial of service for any application attempting to connect to the affected database instance during the outage window.
The operational impact of this vulnerability is substantial for environments where high availability and continuous uptime are critical requirements. Since successful exploitation leads to frequent repeatable crashes, even brief periods of unavailability can disrupt transaction processing, break active connections, and potentially cause data inconsistency if transactions were in progress at the time of the crash. In clustered deployments, a single node failure might trigger failover mechanisms that increase load on remaining nodes, potentially leading to cascading failures across the cluster infrastructure. The requirement for high privileges means that this vulnerability is most dangerous when internal threat actors or compromised administrative accounts are involved, as external attackers without valid credentials cannot directly exploit it through network access alone unless they have previously escalated their privilege level within the database system.
Mitigation strategies should prioritize immediate patching to the latest stable release of MySQL Server and MySQL Cluster where these optimizer flaws have been resolved by Oracle Engineering teams. Organizations must ensure that all production instances running the affected version ranges are updated promptly after verifying compatibility with existing application codebases. In addition to software updates, implementing strict access control policies is essential to minimize the risk surface. Database administrators should enforce the principle of least privilege, ensuring that no service account or user possesses unnecessary high-level privileges such as SUPER or ADMIN roles unless absolutely required for specific operational tasks. Network segmentation can also help by restricting direct database port access to only trusted application servers and management networks, thereby reducing the attack vector even if an attacker gains initial foothold in a lower-privileged network segment.
This vulnerability aligns with Common Weakness Enumeration categories related to resource exhaustion and improper error handling that lead to service disruption. Specifically, it reflects weaknesses where input validation or internal state management fails under specific query patterns, leading to system instability. In the context of MITRE ATT&CK frameworks, this behavior corresponds to techniques involving denial of service through application layer exploitation, particularly those targeting database services for availability impact rather than data theft. Security teams should monitor logs for unusual spikes in connection attempts from privileged accounts or queries that result in frequent process restarts as indicators of potential exploitation activity while patches are being deployed across the environment.