CVE-2026-101774 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Pluggable Authentication component of Oracle MySQL Server and MySQL Cluster products, affecting specific release streams including MySQL Server versions 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, as well as corresponding MySQL Cluster releases in the same version ranges. This security flaw is characterized by a complex logic error or state management issue within the authentication handshake process that allows an unauthenticated attacker to exploit the service over multiple network protocols without requiring prior credentials. The difficulty of exploitation suggests that while the vulnerability is reachable remotely, it requires specific conditions or precise timing to trigger successfully, which aligns with its classification as having high attack complexity in standard scoring models.
From a technical perspective, the core issue involves improper validation or handling of authentication requests during the initial connection phase. When an attacker sends malformed or specifically crafted packets through supported protocols such as TCP/IP, the server fails to correctly process these inputs before proceeding to subsequent stages of session establishment. This failure leads to memory corruption, infinite loops, or state desynchronization within the database engine processes. The impact is twofold: first, it enables a denial-of-service condition where the MySQL Server or Cluster node can be forced into a hang state or experience frequent, repeatable crashes that result in complete service unavailability. Second, under certain conditions, this instability may allow for unauthorized data manipulation, including updates, inserts, or deletes to accessible database objects, thereby compromising data integrity even without full administrative privileges.
The operational impact of this vulnerability is significant due to the critical role MySQL plays in many enterprise infrastructure stacks as a primary relational database management system. A successful exploitation can lead to prolonged downtime affecting dependent applications and services that rely on continuous database availability. Furthermore, if the integrity aspect is triggered, it poses a risk of data corruption or unauthorized modification of sensitive information stored within the affected databases. The CVSS 3.1 base score of 6.5 reflects this balance between high availability impact and lower complexity exploitation requirements compared to critical severity ratings. The vector string AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H indicates that while confidentiality is not directly impacted, integrity loss and availability disruption are the primary concerns for system administrators monitoring these environments.
To mitigate this risk, organizations running affected versions must prioritize applying the latest security patches provided by Oracle as soon as they become available in their respective maintenance channels. Until patching can be implemented, network-level controls should be reviewed to restrict direct access to MySQL ports from untrusted networks or public internet segments. Implementing strict firewall rules that limit source IP addresses allowed to connect to database services is a crucial defensive measure. Additionally, enabling detailed logging and monitoring for unusual authentication failure patterns or connection drops can help in early detection of exploitation attempts. Regular vulnerability scanning against known CVE identifiers associated with MySQL pluggable authentication mechanisms should also be integrated into routine security assessments to ensure timely identification of unpatched instances within the infrastructure.