CVE-2026-101770 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the client programs component of Oracle MySQL Server and MySQL Cluster products, affecting specific version ranges including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding MySQL Cluster versions from 8.0 up to 8.0.49 and the same newer branches. This flaw represents a critical security deficiency that permits an unauthenticated attacker with network access via multiple protocols to compromise the integrity of the database infrastructure. The severity is quantified by a CVSS 3.1 Base Score of 8.1, indicating a High risk level due to significant impacts on confidentiality, integrity, and availability. The attack vector is classified as Network accessible with high complexity requirements, yet it requires no user interaction or prior authentication, making it particularly dangerous in environments where the database ports are exposed to untrusted networks.
From a technical perspective, this vulnerability allows for remote code execution leading to complete system takeover when exploited successfully. While the exploitation difficulty is rated as high, suggesting that specific conditions or precise timing may be required to trigger the flaw, the potential impact remains severe. An attacker who gains control over the MySQL Server process typically operates with the privileges of the database service account. In many deployment scenarios, this account possesses elevated permissions on the underlying operating system, allowing for further lateral movement and persistence within the network infrastructure. The ability to compromise confidentiality means sensitive data stored in the databases can be exfiltrated without detection. Integrity impacts imply that an attacker could alter or delete critical records, disrupting business operations and corrupting data assets. Availability impacts suggest that the vulnerability could potentially be leveraged to cause denial of service conditions by crashing the database services, thereby halting dependent applications.
This incident aligns with Common Weakness Enumeration categories such as CWE-20 Improper Input Validation if the flaw stems from mishandling network packets or input data sent through client protocols. It also maps closely to MITRE ATT&CK techniques related to Initial Access and Execution via Network Service Exploitation, specifically targeting database services like T1190 Exploit Public-Facing Application. The high complexity of exploitation suggests that the vulnerability may involve complex state manipulation or race conditions rather than a simple buffer overflow, requiring sophisticated payload construction by the attacker. However, given the unauthenticated nature of the attack vector, any exposure of these specific MySQL versions to public-facing interfaces significantly increases the risk profile for organizations relying on these systems.
Mitigation strategies must prioritize immediate patching to the latest stable releases within the supported version lines provided by Oracle. Organizations should verify their current deployment against the affected ranges listed and apply vendor-supplied updates as soon as they are available. In environments where patching cannot be performed immediately, network segmentation is critical; database servers should not be directly accessible from untrusted networks such as the internet. Access control lists on firewalls must restrict inbound traffic to specific authorized application server IP addresses using secure protocols like SSH tunneling or TLS-encrypted connections rather than allowing open access via raw TCP ports. Additionally, implementing strict input validation at the application layer can provide a secondary defense mechanism, although it does not replace the need for fixing the underlying software defect. Continuous monitoring of database logs for anomalous connection attempts and unusual query patterns can aid in early detection of exploitation attempts before full system compromise occurs.