CVE-2026-101800 in MySQL Server
Summary
by MITRE • 10/21/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as unauthorized access to critical data or complete access to all MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the privilege management subsystem of Oracle MySQL Server and MySQL Cluster, specifically affecting components responsible for handling user permissions and access control lists. This security flaw impacts a wide range of supported releases across multiple major version branches, including MySQL Server versions 8.4 through 8.4.12, 9.7 through 9.7.3, and the upcoming 26.7 series up to 26.7.1. Similarly, MySQL Cluster installations running versions 8.0 from initial release through 8.0.49, as well as the same 8.4, 9.7, and 26.7 version ranges are susceptible. The core issue involves a logic error or insufficient validation within how the server processes privilege-related requests, allowing for an elevation of privileges that bypasses intended security boundaries despite requiring low-level initial access credentials.
From a technical perspective, this vulnerability is classified as difficult to exploit due to high complexity requirements in crafting valid attack vectors. An attacker must possess network-accessible accounts with at least low-privileged status and utilize multiple communication protocols supported by the MySQL infrastructure to trigger the flaw. The exploitation mechanism likely involves manipulating specific SQL statements or administrative commands that interact poorly with the internal privilege cache or validation routines. When successfully executed, this allows an unauthorized user to perform actions reserved for higher-level administrators, such as creating new users, modifying existing permissions, or altering system configurations without proper authorization checks. This represents a significant breakdown in the principle of least privilege, which is fundamental to secure database architecture and aligns with CWE-269 Improper Privilege Management within standard vulnerability classification frameworks.
The operational impact of this vulnerability is severe regarding data confidentiality and integrity, though availability remains largely unaffected according to the provided CVSS metrics. A successful exploitation enables an attacker to gain unauthorized creation, deletion, or modification access to critical database objects and all accessible data stored within the MySQL environment. This means that sensitive information such as customer records, financial transactions, or proprietary intellectual property could be exfiltrated, altered maliciously, or destroyed entirely by a compromised low-privilege account. The ability to modify privileges further compounds the risk, potentially allowing persistent backdoors or lateral movement across interconnected database systems in enterprise environments. This aligns with ATT&CK techniques related to Privilege Escalation and Defense Evasion, where adversaries seek to expand their foothold within an organization's network infrastructure by abusing legitimate administrative functions through compromised lower-level accounts.
The CVSS 3.1 base score of 6.8 reflects a medium severity rating driven primarily by high impacts on confidentiality and integrity. The vector string AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N indicates that while the attack requires network access, it demands high complexity to execute successfully and does not require user interaction or result in immediate denial of service. However, the potential for complete data compromise makes this a critical concern for database administrators and security operations centers monitoring MySQL deployments. Organizations must assess their exposure by identifying any instances of the affected software versions running on internet-facing servers or internal networks where low-privileged accounts exist with network connectivity to the database engine.
Mitigation strategies should prioritize immediate patching to the latest stable release within each supported version branch, as Oracle typically addresses such privilege escalation flaws in subsequent point releases. In environments where upgrading is not immediately feasible, administrators should implement strict network segmentation to limit access to MySQL ports from untrusted networks and enforce rigorous role-based access control policies that minimize the number of accounts with even low-level privileges capable of executing complex queries or administrative commands. Additionally, enabling detailed audit logging for privilege-related events can help detect attempted exploitation activities in real-time, allowing security teams to respond before significant data integrity issues occur. Regular vulnerability scanning focused on database-specific configurations and continuous monitoring of access patterns are essential components of a defense-in-depth strategy against this type of internal threat actor leveraging legitimate credentials.