Oracle MySQL Server/Cluster: Improper access control in Group Replication
Summary
Oracle MySQL Server and MySQL Cluster versions listed as affected contain an improper access control flaw (CWE-284) in the Group Replication GCS component, which handles group communication between database nodes. An unauthenticated attacker with adjacent network access to the systems running MySQL can compromise the server, with a CVSS 3.1 base score of 8.8 and high impact on confidentiality, integrity and availability. The CVE text refers to a physical communication segment, while the CVSS vector specifies adjacent network access (AV:A), so the exact attack prerequisites should be confirmed in Oracle's advisory.
Affected
- MySQL Server 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, 26.7.0 to 26.7.1 - MySQL Cluster 8.0.0 to 8.0.49, 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, 26.7.0 to 26.7.1
Fixed in
Unknown from verified sources. - Unverified third-party plugin titles suggest MySQL Server 8.4.13, 9.7.4 and 26.10.0, and MySQL Cluster 8.0.50 and 26.10.0. - Confirm the exact fixed build in Oracle's October 2026 CPU advisory before patching.
Workaround
Unknown. No vendor or third-party workaround was found. General measures, not taken from a source: restrict Group Replication traffic to cluster members, separate database nodes from general user networks, and disable Group Replication if the deployment does not use it.
Exploitation
- No evidence of exploitation in the wild was found; the Strix record lists KEV as No. - CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total. - No public proof of concept was found in a short search, so this should be re-checked against CISA KEV and exploit repositories.
Our recommendation
- Confirm the fixed build in Oracle's October 2026 CPU advisory and patch all affected MySQL Server and Cluster instances. - Inventory MySQL Server and Cluster versions and identify all Group Replication deployments. - Patch Group Replication and Cluster systems first and verify that database traffic is limited to cluster members. - Keep MySQL off shared or flat network segments and monitor for unexpected group members or connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- NVD record via Vulners vulners.com
- CVE list record via Vulners vulners.com
- Ubuntu security tracker CVE-2026-101781 ubuntu.com
- Tenable Nessus plugin 370444 www.tenable.com
- Friday We Works: Oracle MySQL October 2026 CPU review fridayweworks.com
- Strix CVE-2026-101781 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:16.
Original description (NVD)
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.