CVE-2026-70724 in MySQL Cluster
Summary
by MITRE • 08/19/2026
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.0-8.0.48, 8.4.0-8.4.11 and 9.7.0-9.7.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the MySQL Cluster product of Oracle MySQL, specifically affecting the General component across supported versions including 8.0 through 8.0.48, 8.4 through 8.4.11, and 9.7 through 9.7.2. This flaw represents a significant security risk due to its potential for unauthenticated remote code execution or system compromise via the Hypertext Transfer Protocol. The vulnerability is classified as difficult to exploit, indicating that while it does not require complex preconditions such as specific user privileges or local access, it demands precise timing or specific input conditions that are not trivially achievable by automated tools alone. This characteristic aligns with Common Weakness Enumeration classifications for vulnerabilities requiring specific environmental contexts or rare trigger conditions, often categorized under CWE-20 Improper Input Validation where the system fails to adequately sanitize or validate incoming data before processing.
The attack vector is strictly network-based and accessible via HTTP, allowing an unauthenticated attacker positioned on a reachable network segment to initiate exploitation attempts without prior authentication credentials. This exposure highlights a critical gap in access control mechanisms within the MySQL Cluster architecture for these specific versions. The requirement for human interaction from a party other than the attacker suggests that the vulnerability may involve social engineering elements or rely on user actions such as clicking malicious links, opening crafted files, or interacting with compromised web interfaces to trigger the underlying code execution path. This dependency introduces an element of unpredictability into the attack lifecycle but does not diminish the severity given the high impact potential once triggered.
Successful exploitation of this vulnerability results in a complete takeover of the MySQL Cluster environment. The CVSS 3.1 base score of 7.5 reflects substantial impacts on confidentiality, integrity, and availability. A score of seven or higher indicates that the vulnerability is considered significant within industry standards for risk assessment. The high impact scores across all three pillars suggest that an attacker can exfiltrate sensitive data, alter database contents to cause logical corruption or fraud, and disrupt service operations leading to denial of access for legitimate users. This level of compromise effectively grants the attacker administrative control over the cluster nodes, enabling further lateral movement within the infrastructure and potential persistence mechanisms.
From a tactical perspective, this vulnerability maps to MITRE ATT&CK techniques involving Initial Access via Phishing or Exploitation for Client Execution if human interaction is required, followed by Privilege Escalation and Lateral Movement as the attacker gains control over the cluster services. The presence of such a flaw in distributed database systems poses severe operational risks because MySQL Cluster often handles critical enterprise data with high availability requirements. Compromise can lead to cascading failures across dependent applications that rely on consistent and secure data retrieval from the cluster nodes.
Mitigation strategies must prioritize immediate patching to the latest stable versions within each supported branch, as Oracle typically releases updates addressing known vulnerabilities in these components. Organizations should also implement network segmentation to restrict HTTP access to MySQL Cluster management interfaces to trusted administrative subnets only. Additionally, deploying Web Application Firewalls with rulesets capable of detecting anomalous input patterns associated with this specific flaw can provide a layer of defense-in-depth. Security teams should monitor for unusual outbound connections or privilege escalation attempts that may indicate successful exploitation has occurred despite preventive controls. Regular vulnerability scanning and penetration testing focused on database-facing services are essential to identify similar misconfigurations or unpatched instances before they can be leveraged by adversaries.