CVE-2026-34267: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Oracle MySQL Serverfrom your environment.If MySQL Server is not required on a host, uninstall or stop and remove the service to eliminate exposure to the vulnerability.
- Configuration
Configure MySQL to not listen on all interfaces (e.g., set bind-address to 127.0.0.1 or a specific management IP) and disable any unnecessary protocol listeners so the server is not exposed to untrusted networks.
Oracle MySQL Server bind-address / network listeners = restrict to localhost or specific trusted IPs; disable unnecessary protocol listeners - Configuration
Revoke or restrict network-access for accounts with high privileges. Ensure administrative/privileged accounts cannot authenticate from untrusted hosts; require use of controlled jump hosts or local access for administration.
Oracle MySQL Server high_privilege_accounts_remote_access = disabled / restricted - Compensating control
Restrict access to MySQL network ports and management interfaces to trusted IPs using firewall rules, network ACLs, or segmentation. Block or limit access from untrusted networks and apply ingress filtering to prevent remote exploitation via exposed protocols.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34267?
CVE-2026-34267 is considered a high severity vulnerability due to its potential to allow high privileged attackers to compromise MySQL Server.
How do I fix CVE-2026-34267?
To fix CVE-2026-34267, update your MySQL Server to a version higher than 8.0.45.
Who is affected by CVE-2026-34267?
CVE-2026-34267 affects users of Oracle MySQL Server versions 8.0.0 to 8.0.45.
What part of MySQL Server is vulnerable in CVE-2026-34267?
CVE-2026-34267 affects the Optimizer component of the MySQL Server.
What is the impact of an attack exploiting CVE-2026-34267?
An attack exploiting CVE-2026-34267 can lead to unauthorized access and potential manipulation of the MySQL Server.