CVE-2026-101748 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Security Audit component of Oracle MySQL Server and MySQL Cluster products, affecting specific release streams including MySQL Server versions 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding MySQL Cluster editions ranging from 8.0 up to 8.0.49 and the same newer version ranges. This flaw represents a significant availability risk because it allows for remote denial of service attacks that can render database services completely unavailable to legitimate users. The vulnerability is classified under CWE-20, which pertains to Improper Input Validation, indicating that the audit subsystem fails to adequately sanitize or validate specific inputs received during security auditing operations. When an attacker provides malformed or specifically crafted data intended for logging or audit trail generation, the internal processing logic encounters a fatal error condition rather than handling it gracefully with appropriate error codes and recovery mechanisms.
Exploitation of this vulnerability requires low-privileged access but does not necessitate user interaction or complex authentication bypasses beyond standard network connectivity. An attacker can leverage multiple database protocols to deliver the malicious payload directly to the MySQL server instance. The attack vector is straightforward, involving the transmission of specially crafted queries or connection parameters that trigger the flawed audit processing routine. Because the vulnerability impacts availability rather than confidentiality or integrity, it does not result in data theft or unauthorized modification but instead causes the server process to hang or crash repeatedly. This behavior aligns with ATT&CK technique T1499, Endpoint Denial of Service, where an adversary disrupts service availability by exhausting resources or causing software failures through targeted input manipulation.
The operational impact of this vulnerability is severe for environments relying on high-availability database clusters. A complete denial of service means that applications dependent on the MySQL instance cannot read or write data, leading to potential business disruption and loss of productivity. In clustered configurations, a crash in one node can trigger failover procedures that may further strain system resources or cause temporary unavailability if not properly configured with robust redundancy measures. The CVSS 3.1 base score of 6.5 reflects the medium severity due to the network-accessible nature of the attack and the low privilege requirement, balanced against the high impact on availability. Organizations must recognize that even without data exfiltration, service interruption poses a critical risk to operational continuity and compliance with uptime SLAs.
Mitigation strategies should prioritize immediate patching by upgrading affected MySQL Server and Cluster installations to versions where this audit subsystem flaw has been resolved. Oracle typically releases security updates in regular maintenance cycles, so administrators should consult the latest Security Alerts for specific build numbers that include the fix. In environments where immediate patching is not feasible due to testing or deployment constraints, network-level controls such as firewalls can be configured to restrict access to MySQL ports from untrusted networks, thereby limiting exposure to potential attackers. Additionally, implementing strict input validation at the application layer before queries reach the database engine may reduce the likelihood of triggering this specific code path, although it is not a substitute for patching the underlying software defect. Regular monitoring of audit logs and system stability metrics can also help in early detection of such denial-of-service attempts, allowing for rapid incident response to minimize downtime.