CVE-2026-101769: High severity Oracle MySQL Cluster vulnerability
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker with network access to MySQL Cluster over TCP can attempt exploitation. No credentials or user interaction are required, although exploitation is described as difficult.
Which deployments are affected?
The affected supported MySQL Cluster versions are 26.7.0 through 26.7.1. The available information does not state whether a particular default configuration is required.
What could a successful attack do?
A successful attack can cause a hang or frequently repeatable crash resulting in complete denial of service. It can also allow unauthorized reading of a subset of accessible data and unauthorized update, insert, or delete operations on some accessible data.
How can teams reduce exposure before patching?
Limit TCP network access to MySQL Cluster so unauthenticated, untrusted systems cannot reach it. The provided information does not identify a configuration-based workaround.