UBUNTU-CVE-2026-101800: Medium severity ubuntu/mysql-5.5 vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as unauthorized access to critical data or complete access to all MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/mysql-8.0to a version that resolves this vulnerability.Fixed in 8.0.46-0ubuntu0.22.04.5 - Upgrade
Upgrade
ubuntu/mysql-8.0to a version that resolves this vulnerability.Fixed in 8.0.46-0ubuntu0.24.04.5 - Upgrade
Upgrade
ubuntu/mysql-9.7to a version that resolves this vulnerability.Fixed in 9.7.4-0ubuntu0.26.10.1 - Upgrade
Upgrade
ubuntu/mysql-8.4to a version that resolves this vulnerability.Fixed in 8.4.13-0ubuntu0.26.04.2
Event History
Frequently Asked Questions
Does exploitation require an authenticated database account?
Yes. The vulnerability requires low privileges, so an attacker must have network access and a low-privileged account or equivalent authenticated access. No user interaction is required.
Is this an availability or data-security concern?
The stated impact is on confidentiality and integrity, not availability. A successful attacker may gain unauthorized read access and create, modify, or delete critical or accessible MySQL Server or MySQL Cluster data.
Which deployments should be checked first?
Check MySQL Server versions 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. For MySQL Cluster, also check versions 8.0.0 through 8.0.49; the provided Ubuntu software list includes mysql-8.0, mysql-5.7, mysql-5.5, MariaDB packages, and Percona Server and XtraDB Cluster packages.
What can reduce exposure while remediation is pending?
Restrict network access to the database service and limit low-privileged accounts to only the users and permissions they require. Because exploitation requires network access and low privileges, reducing reachable endpoints and reviewing database privileges can reduce the opportunity for attack.