IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle MySQL Server and Cluster: Improper access control in client programs

CVE-2026-101771High 8.1

← All vulnerabilities

Summary

The MySQL Server and MySQL Cluster products from Oracle contain a flaw in the client programs component (CWE-284, improper access control). An unauthenticated attacker with network access via multiple protocols can exploit it, although the attack is considered difficult. Oracle and NVD rate the vulnerability 8.1 (High) and describe a possible takeover of the MySQL Server or Cluster with impacts on confidentiality, integrity and availability.

Affected

  • MySQL Server 8.4.0 to 8.4.12
  • MySQL Server 9.7.0 to 9.7.3
  • MySQL Server 26.7.0 to 26.7.1
  • MySQL Cluster 8.0.0 to 8.0.49
  • MySQL Cluster 8.4.0 to 8.4.12
  • MySQL Cluster 9.7.0 to 9.7.3
  • MySQL Cluster 26.7.0 to 26.7.1
  • Standard MySQL Server 8.0 is not in the listed ranges.

Fixed in

Provisional, not yet verified against Oracle's advisory (Tenable plugin titles via Vulners):

  • MySQL Server 8.4.x: 8.4.13
  • MySQL Server 9.x: 9.7.4
  • MySQL Server and Cluster 26.x: 26.10.0
  • MySQL Cluster 8.0.x: 8.0.50

Oracle's October 2026 Critical Patch Update (published 20 October 2026) addresses this CVE.

Workaround

  • No vendor workaround known for this CVE. Patching is the primary action.
  • Until patched, general hardening applies (not CVE-specific): do not expose ports 3306 and 33060 to the internet, remove anonymous and duplicate '%' accounts, restrict root to localhost.
  • Restrict which clients can connect and enforce encrypted connections where possible.

Exploitation

  • Unknown. No evidence of in-the-wild exploitation, CISA KEV listing or public proof of concept was found.
  • CISA SSVC: exploitation none, not automatable, technical impact total.
  • EPSS 0.00348 (low).

Our recommendation

  • Inventory all MySQL Server and Cluster instances and client libraries, including versions.
  • Patch to the fixed versions after confirming the mapping in Oracle's October 2026 Critical Patch Update.
  • Prioritise internet-facing or broadly reachable MySQL 8.4, 9.7 and 26.7 servers and all MySQL Cluster 8.0 deployments.
  • Update client tools and libraries on workstations and application servers as well.
  • Check that database ports are not reachable from untrusted networks and monitor for unusual connections.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:25.

Original description (NVD)

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed