CVE-2026-101797 in MySQL Cluster
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the mysqldump utility of Oracle MySQL Server and MySQL Cluster products, specifically affecting versions 8.4 through 8.4.12, 9.7 through 9.7.3, and 26.7 through 26.7.1 across both server and cluster deployments. This component is critical for database backup operations but has been found to contain a flaw that allows an unauthenticated attacker with network access via multiple protocols to compromise the underlying system. The severity of this issue is rated at CVSS v3.1 Base Score 7.5, indicating a high level of risk due to its potential impact on confidentiality, integrity, and availability. Despite being classified as difficult to exploit, which suggests a higher complexity in crafting successful attack vectors, the consequence of a successful exploitation is severe: complete takeover of the MySQL Server or Cluster environment. This outcome aligns with CWE-78, Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection, where user-supplied input is not adequately sanitized before being passed to system-level commands.
The operational impact of this vulnerability extends beyond simple data exposure. An attacker who successfully exploits this flaw can achieve remote code execution with the privileges of the MySQL service account. In many deployment scenarios, particularly in legacy or poorly configured environments, these services run with elevated permissions that may include access to sensitive files on the host operating system. This capability allows for lateral movement within a network infrastructure, enabling attackers to pivot from the database server to other critical systems. The requirement for human interaction implies that the attack vector likely involves social engineering tactics, such as tricking an administrator into executing a maliciously crafted dump file or interacting with a compromised backup interface. This characteristic maps closely to ATT&CK technique T1566.002, Phishing: Spearphishing Attachment, where attackers deliver payloads disguised as legitimate database dumps or configuration files that trigger the vulnerable code path upon processing by mysqldump.
From a technical perspective, the vulnerability likely stems from improper handling of specific input parameters within the dump process, allowing an attacker to inject shell metacharacters or manipulate command-line arguments that are subsequently executed by the operating system. The fact that it affects multiple protocols suggests that the entry point is not limited to a single network service but may be triggered through various client connections or automated backup scripts that utilize mysqldump functionality. This broad attack surface increases the likelihood of exploitation in environments where database backups are performed automatically without rigorous input validation on external data sources. The difficulty in exploitation serves as a partial mitigation, requiring attackers to carefully craft payloads that bypass existing security controls and trigger specific edge cases within the dump logic, but it does not eliminate the risk entirely given the high privilege level typically associated with database services.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is to apply the latest patches provided by Oracle for all affected MySQL Server and Cluster versions immediately. Organizations should verify their inventory of databases running vulnerable versions and prioritize updates based on exposure levels. In addition to patching, administrators should review backup procedures to ensure that mysqldump is not processing untrusted or externally sourced data without validation. Implementing strict input sanitization in any custom scripts that invoke mysqldump can prevent the injection of malicious commands. Furthermore, adopting a principle of least privilege for database service accounts reduces the impact if an exploit occurs by limiting the operating system-level permissions available to the MySQL process. Security monitoring should be enhanced to detect unusual patterns in backup activities or command executions originating from database servers, which may indicate active exploitation attempts aligned with ATT&CK technique T1059, Command and Scripting Interpreter.