CVE-2026-61096 in MySQL Cluster
Summary
by MITRE • 07/22/2026
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability under discussion affects the pluggable authentication component of MySQL Server and MySQL Cluster products manufactured by Oracle. This security flaw exists within specific version ranges including MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, alongside MySQL Cluster versions 8.0.0 through 8.0.47 and 8.4.0 through 8.4.10, along with the same 9.7.0 through 9.7.1 range. The vulnerability manifests as a weakness in the authentication subsystem that allows for unauthorized data manipulation operations. According to the CVSS 3.1 scoring system, this vulnerability carries a base score of 2.9 which indicates a low severity classification with integrity impacts specifically. The attack vector is classified as local access (AV:L) meaning an attacker must already have logon credentials to the target infrastructure where MySQL Server or Cluster operates, and requires high complexity (AC:H) to exploit, suggesting that the attack method is not trivially simple.
The technical nature of this vulnerability lies within the pluggable authentication mechanism which serves as a critical security control for database access management. When an attacker successfully exploits this flaw, they can achieve unauthorized modification capabilities against certain data elements accessible through the MySQL server or cluster environment. The impact scope primarily affects data integrity rather than confidentiality or availability, as evidenced by the CVSS vector showing low integrity impact (I:L) and no confidentiality (C:N) or availability (A:N) implications. This suggests that while malicious actors could alter database records, they cannot necessarily read sensitive information or cause complete system disruption through this specific vulnerability. The vulnerability's classification aligns with CWE-284 which addresses improper access control issues, particularly focusing on authentication mechanisms that fail to properly validate user privileges.
Operationally, the exploitation of this vulnerability requires an attacker to already possess legitimate credentials for accessing the target system, which significantly reduces the attack surface compared to remotely exploitable flaws. However, this still represents a serious concern for organizations as it allows for privilege escalation within the database environment from a compromised local account. The low base score does not diminish the importance of addressing this vulnerability since unauthorized data modification can lead to significant business impact including financial losses, compliance violations, and operational disruptions. Organizations maintaining these vulnerable MySQL versions should consider the potential for insider threats or compromised accounts to be particularly dangerous given that this vulnerability allows for data integrity compromise without requiring additional authentication factors.
Mitigation strategies should focus on immediate patching of affected systems to the latest stable releases which address the authentication mechanism flaws. Network segmentation and privilege minimization practices should be enforced to limit the potential impact of any successful exploitation attempts. Regular security assessments and monitoring of database access logs can help detect unusual modification patterns that might indicate exploitation attempts. Additionally, implementing multi-factor authentication for database access and maintaining strict access control policies will further reduce the risk associated with this vulnerability. The ATT&CK framework would categorize this as a privilege escalation technique under the T1068 category related to exploit for privilege escalation, emphasizing the need for layered security approaches that prevent attackers from leveraging compromised credentials to gain additional access rights. Organizations should also consider implementing database activity monitoring solutions that can detect anomalous modification patterns consistent with the integrity impact described in this vulnerability assessment.