Oracle MySQL Server/Cluster: Improper access control in Client programs
Summary
Oracle MySQL Server and MySQL Cluster in several 8.4, 9.7 and 26.7 versions (Cluster also 8.0) contain an improper access control flaw in the Client programs component. An unauthenticated attacker with network access can, under high attack complexity, take over the database and affect its confidentiality, integrity and availability. Oracle rates the CVSS 3.1 base score at 8.1. No exploitation or public proof of concept is known.
Affected
- MySQL Server 8.4.0 to 8.4.12
- MySQL Server 9.7.0 to 9.7.3
- MySQL Server 26.7.0 to 26.7.1
- MySQL Cluster 8.0.0 to 8.0.49
- MySQL Cluster 8.4.0 to 8.4.12
- MySQL Cluster 9.7.0 to 9.7.3
- MySQL Cluster 26.7.0 to 26.7.1
The per-version table in Oracle's advisory has not been verified.
Fixed in
- MySQL Server 8.4.13, 9.7.4 and 26.10.0 (from scanner data, not yet confirmed by Oracle for this CVE)
- MySQL Cluster 8.4.13, 9.7.4 and 26.10.0 (same caveat)
- MySQL Cluster 8.0: Unknown. Fix 8.0.50 appears only in scanner data, and MySQL 8.0 reached end of life with 8.0.46.
Workaround
- Unknown: Oracle has not published a workaround for this CVE.
- If patching is delayed, restrict network access to the MySQL port (3306 by default) to application hosts only.
Exploitation
- No confirmed exploitation known. CISA SSVC: exploitation none, not automatable.
- No public proof of concept found.
- EPSS score 0.00348 (low).
Our recommendation
- Inventory all MySQL instances, including Cluster, Docker images and managed services, and confirm the exact versions.
- Update MySQL Server to 8.4.13, 9.7.4 or 26.10.0 as appropriate, and ask Oracle whether an 8.0 Cluster patch exists.
- Confirm that database ports are not reachable from the internet.
- Prioritise internet-exposed instances.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alerts: October 2026 CPU www.oracle.com
- Oracle MySQL October 2026 GA releases blogs.oracle.com
- MySQL 8.4.13 release notes dev.mysql.com
- Ubuntu security notice CVE-2026-101770 ubuntu.com
- OSV entry CVE-2026-101770 (Vulners) vulners.com
- NVD record CVE-2026-101770 (Vulners) vulners.com
- Oracle MySQL vulnerabilities October 2026 (SecurityOnline) securityonline.info
- Oracle October 2026 CPU analysis (Tenable) www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:24.
Original description (NVD)
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.