REDHAT-BUG-2505182: Low severity Oracle MySQL Server vulnerability

Q: Who can realistically exploit this issue?

An attacker must be able to log on to the infrastructure hosting MySQL Server or MySQL Cluster. The CVSS vector identifies the attack as local, with no MySQL privileges or user interaction required, but exploitation is considered difficult.

Q: What is the potential impact if exploitation succeeds?

A successful attack can provide unauthorized update, insert, or delete access to some data accessible to the affected MySQL Server or MySQL Cluster instance. The stated impact is limited to integrity; no confidentiality or availability impact is specified.

Q: Which releases are identified as affected?

Affected MySQL Server releases are 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1. Affected MySQL Cluster releases are 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.

Published Jul 21, 2026

Updated

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected Software

2 affected components

Oracle MySQL Server>=8.4.0<=8.4.10, >=9.7.0<=9.7.1

Oracle MySQL Cluster>=8.0.0<=8.0.47, >=8.4.0<=8.4.10, >=9.7.0<=9.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle MySQL (MySQL Server, MySQL Cluster) - Server: Pluggable Auth to a version that resolves this vulnerability.
Fixed in 8.4.0-8.4.10
Upgrade
Upgrade Oracle MySQL (MySQL Server, MySQL Cluster) - Server: Pluggable Auth to a version that resolves this vulnerability.
Fixed in 9.7.0-9.7.1
Upgrade
Upgrade Oracle MySQL (MySQL Server, MySQL Cluster) - Server: Pluggable Auth to a version that resolves this vulnerability.
Fixed in 8.0.0-8.0.47

Event History

Jul 21, 2026

Data Sourced

via Red Hat·10:21 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can realistically exploit this issue?

An attacker must be able to log on to the infrastructure hosting MySQL Server or MySQL Cluster. The CVSS vector identifies the attack as local, with no MySQL privileges or user interaction required, but exploitation is considered difficult.

What is the potential impact if exploitation succeeds?

A successful attack can provide unauthorized update, insert, or delete access to some data accessible to the affected MySQL Server or MySQL Cluster instance. The stated impact is limited to integrity; no confidentiality or availability impact is specified.

Which releases are identified as affected?

Affected MySQL Server releases are 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1. Affected MySQL Cluster releases are 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.

REDHAT-BUG-2505182: Low severity Oracle MySQL Server vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can realistically exploit this issue?

What is the potential impact if exploitation succeeds?

Which releases are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can realistically exploit this issue?

What is the potential impact if exploitation succeeds?

Which releases are identified as affected?