CVE-2026-101769 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the MySQL Cluster product of Oracle MySQL, specifically affecting component versions ranging from 26.7.0 to 26.7.1. This security flaw is categorized under the General cluster functionality and presents a significant risk due to its potential for causing severe service disruption and data compromise. The nature of this vulnerability allows an unauthenticated attacker who has network access via TCP to exploit the defect remotely. Although the exploitation difficulty is classified as high, meaning it requires specific conditions or complex sequences to trigger successfully, the consequences of a successful attack are substantial. This classification aligns with Common Weakness Enumeration standards that highlight flaws in input validation and state management within distributed database systems where improper handling of cluster synchronization messages can lead to instability.
The operational impact of this vulnerability is multifaceted, affecting all three pillars of the CIA triad: confidentiality, integrity, and availability. The most immediate consequence is a denial of service condition. An attacker can trigger events that cause MySQL Cluster to hang or experience frequent, repeatable crashes. This complete loss of availability disrupts business operations dependent on real-time data access and high-availability clustering features. Beyond the disruption of service, the vulnerability also permits unauthorized modifications to the database state. Specifically, it allows for unauthorized updates, inserts, or deletes against accessible data within the cluster. This represents a critical integrity failure where an attacker can alter records without proper authentication, potentially leading to data corruption or malicious manipulation of business-critical information stored in the distributed nodes.
Furthermore, the vulnerability extends beyond write operations to include read access violations. An unauthenticated actor may gain unauthorized read access to a subset of MySQL Cluster accessible data. This breach of confidentiality means that sensitive information protected by standard authentication mechanisms can be exfiltrated if the attacker successfully exploits this flaw. The combination of these impacts results in a CVSS 3.1 Base Score of 7.0, indicating a High severity rating. The vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) reflects that while the attack requires high complexity and no user interaction or prior privileges, it results in low confidentiality impact, low integrity impact, but high availability impact due to the potential for complete system crashes. This profile suggests an attacker focused on disruption rather than data theft might find this vulnerability particularly useful for causing operational chaos within a targeted organization's infrastructure.
From a threat intelligence perspective, this type of vulnerability often maps to ATT&CK techniques involving resource hijacking or service exhaustion, as well as unauthorized access to sensitive information if the read component is fully exploited. The lack of authentication requirement makes it attractive for automated scanning tools and opportunistic attackers targeting exposed database ports on public networks. To mitigate these risks, organizations running MySQL Cluster versions 26.7.0 through 26.7.1 must prioritize applying the latest security patches provided by Oracle immediately. If patching is not immediately feasible, network-level controls such as firewall rules restricting TCP access to port 3306 and related cluster communication ports should be strictly limited to trusted IP addresses only. Additionally, implementing intrusion detection systems capable of identifying anomalous traffic patterns associated with cluster protocol exploitation can provide an additional layer of defense against attempts to trigger the hang or crash conditions described in this advisory.