CVE-2026-101781: High severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mysql-9.7to a version that resolves this vulnerability.Fixed in 9.7.4-2
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Affected deployments are MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49 and the listed 8.4, 9.7, and 26.7 releases. Exploitation requires access to the physical communication segment attached to the hardware running the affected server or cluster.
Does an attacker need MySQL credentials or user interaction?
No. The vulnerability is described as unauthenticated and requires no user interaction; the attacker needs network-adjacent access to the relevant physical communication segment.
What is the potential impact of successful exploitation?
A successful attack can result in takeover of MySQL Server or MySQL Cluster. The reported CVSS impacts include high confidentiality, integrity, and availability impact.