CVE-2026-101754 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the client programs component of Oracle MySQL Server and MySQL Cluster products, affecting specific version ranges including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding versions of MySQL Cluster. This flaw is classified under CWE-400, which denotes uncontrolled resource consumption leading to denial of service conditions. The technical nature of the defect allows for a scenario where an attacker can trigger a hang or a frequently repeatable crash within the database engine. While the vulnerability requires high privileges and network access via multiple protocols to exploit, its successful execution results in a complete loss of availability for the MySQL Server or Cluster instance. This aligns with ATT&CK technique T1499, Endpoint Denial of Service, specifically reflecting behaviors that exhaust system resources to disrupt service continuity.
The operational impact of this vulnerability is significant due to the critical role MySQL plays in many enterprise infrastructure stacks as a primary data store for web applications and internal services. A successful exploitation leads to unauthorized denial of service, effectively rendering the database engine unresponsive or causing it to terminate unexpectedly. This disruption prevents authorized users from accessing stored data, executing queries, or performing administrative tasks until the service is manually restarted or recovered. The CVSS 3.1 base score of 4.4 reflects a medium severity level primarily driven by availability impacts rather than confidentiality or integrity breaches. The vector indicates that while network access and high privilege are required prerequisites, the ease of causing a crash makes it a persistent threat to system stability if proper controls are not in place.
Mitigation strategies should focus on strict access control policies to ensure that only trusted, authenticated users with appropriate privileges can connect via the affected client protocols. Organizations must verify their MySQL versions against the supported ranges and apply available patches or updates from Oracle immediately upon release. Additionally, implementing network segmentation to restrict database port accessibility to known application servers and administrative workstations reduces the attack surface. Monitoring tools should be configured to detect unusual patterns of connection attempts or resource spikes that may indicate an attempted exploitation of this denial-of-service flaw. Regular auditing of user privileges ensures that high-privileged accounts are not unnecessarily exposed to network-accessible services, thereby raising the barrier for potential attackers seeking to leverage this vulnerability.