CVE-2026-101750 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Clone Plugin component of Oracle MySQL Server and MySQL Cluster products, affecting specific release streams including MySQL Server versions 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding MySQL Cluster releases in the same version ranges. This security flaw is classified under CWE-400, which denotes uncontrolled resource consumption leading to denial of service conditions. The vulnerability manifests when an attacker with high-level privileges interacts with the Clone Plugin via network-accessible protocols such as TCP/IP or X Protocol. Although the requirement for high privileged access significantly raises the barrier to entry compared to remote code execution flaws, it does not eliminate the risk entirely in environments where administrative credentials may be compromised through credential stuffing, insider threats, or lateral movement from other breached systems.
The technical nature of this flaw allows an attacker to trigger a hang or induce frequent, repeatable crashes within the MySQL Server or Cluster processes. This behavior directly impacts the availability component of the CIA triad, resulting in a complete denial of service where legitimate users are unable to connect to the database engine or execute queries. The operational impact is severe for production environments relying on high availability architectures, as repeated crashes can disrupt replication streams, cause failover events that may lead to data inconsistency if not properly managed by cluster management tools, and result in significant downtime for dependent applications. The CVSS 3.1 base score of 4.9 reflects the medium severity driven primarily by the high impact on availability despite the requirement for privileged access and local or network proximity constraints.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates Denial of Service (T1499) activities specifically targeting infrastructure services to disrupt operational continuity. Attackers may leverage this flaw as part of a broader campaign where database unavailability is used to mask other malicious activities or simply to cause business disruption. The exploitability vector indicates that while the attack complexity is low, requiring minimal specialized conditions once access is gained, the prerequisite of high privilege means it cannot be exploited by anonymous external actors without prior compromise of administrative accounts.
Mitigation strategies should prioritize immediate patching to the latest stable versions within each supported release branch where this vulnerability has been addressed. Organizations must ensure that their MySQL instances are updated according to Oracle Critical Patch Update advisories for the respective product lines. In addition to software updates, strict access control policies should be enforced to limit who holds administrative privileges on database servers. Network segmentation and firewall rules can further restrict direct network access to database ports from untrusted networks, reducing the attack surface even if privileged credentials are compromised. Monitoring tools should also be configured to detect abnormal spikes in connection attempts or process restarts that may indicate exploitation of this denial-of-service flaw.