CVE-2026-101772 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the client programs component of Oracle MySQL Server and MySQL Cluster products, affecting a broad range of supported versions including MySQL Server 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1, as well as corresponding releases of MySQL Cluster from version 8.0 up to 8.0.49 and the same ranges for newer cluster editions. This flaw represents a critical security deficiency that allows an unauthenticated attacker with network access via multiple protocols to compromise the integrity and availability of the database infrastructure. The severity is quantified by a CVSS v3.1 Base Score of 8.1, indicating a High risk level due to significant impacts on confidentiality, integrity, and availability. Although the vulnerability is classified as difficult to exploit, requiring high complexity in attack execution, its potential for remote code execution or service takeover without prior authentication makes it particularly dangerous in environments where database ports are exposed to untrusted networks.
From a technical perspective, this vulnerability likely stems from improper validation of input data within the client-side processing logic that handles network protocol interactions. When an attacker sends specially crafted packets over supported protocols such as TCP/IP, the server may fail to correctly process or sanitize these inputs before execution. This failure can lead to memory corruption, stack overflow conditions, or logical errors in authentication bypass mechanisms. The ability to compromise MySQL Server implies that an adversary could potentially execute arbitrary code with the privileges of the database service account, which often possesses extensive permissions within the operating system and data storage layers. Such a scenario aligns closely with CWE-20 Improper Input Validation and CWE-78 OS Command Injection if command execution is involved, or CWE-190 Integer Overflow/Wraparound if memory corruption is the root cause. The multi-vector nature of the attack surface suggests that multiple entry points across different protocol handlers are susceptible to this flaw, increasing the likelihood of successful exploitation despite the high complexity requirement.
The operational impact of a successful exploit is severe and multifaceted. An attacker gaining control over MySQL Server can exfiltrate sensitive data stored within databases, leading to significant breaches of confidentiality in compliance with regulations such as GDPR or HIPAA. Furthermore, the ability to modify database contents undermines data integrity, allowing for unauthorized changes that could disrupt business operations or manipulate financial records. The availability impact is equally critical; an attacker could crash the MySQL service through denial-of-service techniques embedded within the exploit payload, rendering applications dependent on the database unavailable and causing operational downtime. In a clustered environment like MySQL Cluster, compromising one node can potentially lead to cascading failures across the cluster, amplifying the scope of the disruption. The CVSS vector components AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflect that while network access is required and complexity is high, no user interaction or prior authentication is needed, making this a remote attack vector with full impact potential on all three security pillars.
Mitigation strategies must prioritize immediate patching of the affected MySQL Server and Cluster versions to their latest stable releases provided by Oracle. Organizations should verify that they are running patched builds within the specified version ranges. In cases where immediate patching is not feasible due to compatibility concerns, network segmentation becomes a critical compensating control. Database servers should be placed in isolated subnets accessible only from trusted application server IP addresses, effectively blocking unauthenticated access attempts from external networks or less secure internal segments. Additionally, implementing strict firewall rules that restrict inbound traffic on MySQL ports (typically 3306) to authorized hosts can significantly reduce the attack surface. Security teams should also monitor for anomalous network activity indicative of exploitation attempts, such as unusually large packets or repeated connection failures from unknown sources. Regular vulnerability scanning and penetration testing focused on database interfaces are recommended to ensure that no other unpatched instances remain exposed. Adhering to these practices aligns with MITRE ATT&CK techniques related to Initial Access via Network Service Exploitation and helps maintain a robust security posture against evolving threats targeting database infrastructure.