CVE-2026-101628: Medium severity Oracle MySQL Cluster vulnerability

Published Oct 20, 2026

Updated

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). The supported version that is affected is 9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Affected Software

1 affected component

Oracle MySQL Cluster=9.7.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle MySQL Cluster: NDB Operator to a version that resolves this vulnerability.
Fixed in 9.7.3

Event History

Oct 20, 2026

CVE Published

via MITRE·09:21 PM

Data Sourced

via MITRE·09:21 PM

DescriptionSeverity

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker needs network access to the affected NDB Operator over HTTP and low-privileged credentials. No user interaction is required.

What is the practical impact of a successful attack?

A successful attack can cause MySQL Cluster to hang or crash repeatedly, resulting in a complete denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.

Which deployment should be prioritized for remediation?

MySQL Cluster deployments using the NDB Operator on the affected supported version, 9.7.3, should be prioritized, particularly where low-privileged users can reach its HTTP interface over the network.