CVE-2026-60569 in MySQL Cluster
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Cluster executes to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Cluster accessible data. CVSS 3.1 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle MySQL Cluster's NDB Operator component, representing a significant security weakness that affects multiple version ranges including 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. The flaw manifests as a difficulty in exploitation condition that requires an attacker to already possess logon credentials to the MySQL Cluster execution environment, making it a privilege escalation risk rather than a direct remote attack vector. The vulnerability's classification under CVSS 3.1 with a base score of 5.1 indicates a medium severity threat primarily impacting confidentiality aspects of the system.
The technical nature of this flaw stems from insufficient access controls within the NDB Operator functionality, which allows an authenticated attacker who has already gained infrastructure access to potentially compromise the entire MySQL Cluster deployment. This represents a critical weakness in the principle of least privilege implementation where proper authorization checks may be missing or inadequately enforced during cluster operations. The vulnerability's attack vector is classified as local access (AV:L) meaning it requires physical or network-level presence on the target system, while the high complexity requirement (AC:H) suggests that sophisticated techniques are needed to exploit the flaw successfully.
The operational impact of this vulnerability extends beyond simple data theft, potentially enabling complete unauthorized access to all MySQL Cluster accessible data through the compromised operator functionality. This threat model aligns with CWE-284 (Improper Access Control) and follows patterns commonly seen in database operator privilege escalation attacks. Attackers could leverage this weakness to extract sensitive information, modify cluster configurations, or potentially disrupt services through manipulation of the underlying NDB storage engine operations. The confidentiality impact rating of HIGH (C:H) reflects the potential for unauthorized disclosure of critical database content.
Organizations should implement immediate mitigations including ensuring proper network segmentation to limit access to MySQL Cluster infrastructure, enforcing strong authentication controls, and applying the latest security patches from Oracle when available. The ATT&CK framework categorizes this vulnerability under privilege escalation techniques where attackers leverage legitimate administrative tools to gain elevated access rights. Security monitoring should focus on unusual operator activity patterns, unauthorized configuration changes, and any suspicious logon events within the MySQL Cluster environment. Organizations using affected versions should also consider implementing additional network-level controls such as firewall rules restricting access to cluster ports and services, while maintaining comprehensive audit trails for all cluster operations.
This vulnerability demonstrates the importance of proper privilege management in distributed database systems and highlights how seemingly minor access control gaps can lead to significant data compromise scenarios. The attack scenario requires an initial foothold on the infrastructure but once achieved provides substantial access rights that could be leveraged for further exploitation within the MySQL Cluster environment. Regular security assessments of database operator components should include thorough reviews of access controls, authentication mechanisms, and privilege escalation pathways to prevent similar vulnerabilities from being exploited in production environments.