CVE-2026-71084 in MySQL Connectors
Summary
by MITRE • 08/19/2026
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Connector/ODBC component of Oracle MySQL Connectors, specifically affecting version 26.7.0 and potentially other supported releases in that lineage. This security flaw represents a significant risk to database infrastructure integrity because it allows for exploitation by an unauthenticated attacker who has established network-level access or logon credentials to the underlying operating system where the Connector/ODBC service is executing. The nature of this vulnerability indicates a failure in input validation or state management within the ODBC driver, which serves as the bridge between applications and MySQL database servers. By leveraging this flaw, an adversary can manipulate internal processes without needing prior authentication at the application layer, relying instead on their presence within the local infrastructure to trigger malicious code paths.
The operational impact of exploiting this vulnerability is twofold, targeting both availability and confidentiality in accordance with the CVSS 3.1 scoring model which assigns a base score of 6.8. The primary consequence is a denial of service condition characterized by frequent repeatable crashes or complete hangs of the MySQL Connectors process. This disruption effectively halts database connectivity for any application relying on this specific connector, leading to significant downtime and potential data processing failures across dependent systems. Furthermore, the vulnerability permits unauthorized read access to a subset of data accessible by the Connector/ODBC instance itself. While it does not grant direct write or execute privileges, the ability to exfiltrate sensitive information from memory buffers or cached query results poses a severe confidentiality risk, potentially exposing proprietary business logic, user credentials, or other confidential database contents stored temporarily during connection handling.
From a technical classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption if the crash is triggered by resource exhaustion. The attack vector corresponds to ATT&CK technique T1530 Data from Local System Exfiltration for the data access aspect and T1499 Endpoint Denial of Service via application crashes or hangs for the availability impact. Because the attacker requires logon capability, this represents a local privilege escalation scenario where initial foothold on the host is leveraged to compromise the database connectivity layer. The lack of authentication requirement at the connector level means that any user account with basic shell access can potentially trigger these conditions without needing elevated privileges or complex social engineering tactics.
Mitigation strategies must focus on immediate patching and network segmentation until updates are applied. Organizations should prioritize upgrading Oracle MySQL Connectors to a version where this flaw has been remediated, as vendor patches typically address the underlying memory handling errors that lead to crashes and unauthorized data exposure. In environments where immediate patching is not feasible, strict access controls must be enforced on all systems running Connector/ODBC 26.7.0. This includes restricting local logon privileges to only essential administrative accounts and implementing host-based firewalls or intrusion detection systems to monitor for anomalous connection patterns that may indicate exploitation attempts. Additionally, deploying the connector behind a reverse proxy or application firewall can help filter malicious payloads before they reach the vulnerable component, reducing the attack surface available to potential adversaries operating within the local network perimeter.