CVE-2026-60178: Medium severity Oracle MySQL Server vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or remove usage of the vulnerable Server: Clone Plugin component if it is not required, and ensure the service is not exposed over the network until patched.
MySQL Server, MySQL Cluster (Server: Clone Plugin) Clone Plugin = Disable
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60178?
CVE-2026-60178 has a medium severity rating of 6.6.
How do I fix CVE-2026-60178?
To fix CVE-2026-60178, upgrade MySQL Server and MySQL Cluster versions to the latest patched releases.
What software is affected by CVE-2026-60178?
CVE-2026-60178 affects Oracle MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as Oracle MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1.
What kind of vulnerability is CVE-2026-60178?
CVE-2026-60178 is a difficult to exploit vulnerability in the Clone Plugin of the MySQL Server.
Is CVE-2026-60178 a critical vulnerability?
No, CVE-2026-60178 is classified as a medium severity vulnerability.