CVE-2026-60177 in MySQL Cluster
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within the MySQL Server and MySQL Cluster products, specifically affecting the Server: Clone Plugin component. The affected versions span multiple release lines including MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, alongside MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. The vulnerability represents a significant availability risk that can be exploited by attackers with high privileges and network access through multiple protocols. According to the CVSS 3.1 scoring system, this flaw carries a base score of 4.4 with a vector indicating network accessibility, high attack complexity, high privilege requirements, and no user interaction needed. The severity classification places it in the medium range for availability impacts, though the potential for complete denial of service makes it particularly concerning for database infrastructure.
The technical nature of this vulnerability allows for a complete denial of service condition where successful exploitation can result in either a hang or frequently repeatable crashes within the MySQL Server and Cluster environments. This behavior indicates that the flaw likely resides in memory management, resource handling, or protocol processing within the clone plugin functionality that is responsible for database cloning operations. The attack vector requires network access combined with high privileged credentials, suggesting that this vulnerability could be exploited by authenticated users with administrative privileges or by attackers who have already compromised administrative accounts within the database environment.
From an operational impact perspective, the availability compromise poses serious risks to database services that depend on MySQL Server and Cluster implementations. Organizations utilizing these database systems face potential disruptions to critical business applications that rely on continuous database availability. The vulnerability's characteristic of causing repeatable crashes means that even a single successful exploitation attempt could lead to sustained service degradation or complete system unavailability until manual intervention occurs. This type of vulnerability particularly affects environments where database clustering and replication are critical components of the infrastructure, as cluster nodes may become unavailable or enter unstable states.
The attack surface for this vulnerability extends across multiple protocols, indicating that it likely affects core database communication mechanisms rather than specific application interfaces. This broad impact suggests that network-level exploitation is possible through standard MySQL protocol implementations, potentially affecting connections established via TCP/IP, Unix domain sockets, or other supported connection methods. Organizations should consider implementing network segmentation and access controls to limit exposure while awaiting patches or mitigation strategies. The CVSS vector configuration with high attack complexity and high privilege requirements indicates that this vulnerability is not trivially exploitable by casual attackers but represents a legitimate threat for determined adversaries with administrative access.
Security practitioners should note the relationship between this vulnerability and established cybersecurity frameworks such as CWE (Common Weakness Enumeration) which would likely classify this under weakness categories related to resource management or input validation failures. The ATT&CK framework would categorize this vulnerability within the context of privilege escalation and denial of service tactics, potentially falling under techniques for maintaining access through service disruption or resource exhaustion. Organizations should prioritize patch management activities to address this vulnerability in affected versions, while also implementing monitoring solutions that can detect unusual patterns of database crashes or connection failures that might indicate exploitation attempts.
Mitigation strategies should include immediate deployment of Oracle's security patches once available, along with network-level controls such as firewall rules limiting access to database ports from trusted sources only. Database administrators should review and tighten privilege assignments to minimize the risk of unauthorized access by potentially malicious users. Additionally, implementing robust monitoring and alerting mechanisms for database service stability can help detect exploitation attempts or successful attacks before they cause significant operational impact. The vulnerability's classification as a high-privilege requirement means that organizations with strong identity and access management controls may be less vulnerable, but the potential for complete service disruption makes proactive mitigation essential for all affected environments.