CVE-2026-60332 in MySQL Cluster
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under discussion affects Oracle MySQL Server and MySQL Cluster implementations, specifically within the Group Replication Global Communication Service component that facilitates distributed database operations. This issue resides in the server infrastructure that manages group replication functionality, which is critical for maintaining data consistency across multiple database instances in a clustered environment. The affected versions span multiple release lines including MySQL 8.4.0 through 8.4.10, 9.7.0 through 9.7.1 for standard server deployments, and various MySQL Cluster releases from 8.0.0 through 8.0.47, along with the same 8.4.0-8.4.10 and 9.7.0-9.7.1 ranges. The vulnerability represents a significant security weakness that could lead to complete system compromise when exploited properly.
Technical analysis reveals this is a privilege escalation vulnerability that requires an attacker to already possess valid login credentials for the system hosting the MySQL components, but does not require special privileges or elevated access rights beyond standard authentication. The flaw exists within the Group Replication GCS layer which handles communication between database nodes in a replication group, making it particularly dangerous as it could allow an authenticated attacker to gain control over the entire database cluster infrastructure. This type of vulnerability falls under CWE-284 Access Control Issues, specifically related to insufficient privileges during distributed operations. The complexity of exploitation is rated as high due to the requirement for local system access and the need to properly leverage the Group Replication functionality. The CVSS 3.1 scoring reflects the severity with a base score of 6.4 indicating high impact across confidentiality, integrity, and availability domains.
The operational impact of this vulnerability extends far beyond simple data compromise, as successful exploitation could result in complete takeover of the MySQL Server or Cluster infrastructure. This would enable attackers to execute arbitrary commands on the database servers, potentially leading to data exfiltration, modification of critical database content, or complete service disruption across the entire replication group. The attack vector requires local access to the target system, making it more difficult to exploit remotely but still highly concerning for environments where physical or administrative access could be compromised. Organizations running MySQL in clustered configurations face particular risk as this vulnerability could allow attackers to disrupt database availability or compromise data integrity across multiple nodes simultaneously.
Mitigation strategies should focus on immediate patching of affected versions and implementation of additional access controls to limit local system access. Network segmentation and privilege separation measures can reduce the attack surface, while monitoring for unusual Group Replication activity may help detect exploitation attempts. Security teams should implement comprehensive access logging and review privileged account usage patterns. The vulnerability's classification under ATT&CK technique T1078 Valid Accounts suggests that defending against this requires robust identity and access management controls. Organizations should also consider implementing database activity monitoring solutions specifically designed to detect anomalous replication behavior and unauthorized configuration changes within MySQL Group Replication environments, particularly focusing on the communication protocols used by the GCS component.