https://seclists.org/oss-sec/2026/q3/783: CVE-2026-60163: MySQL Group plication unauthenticated mote arbitrary SQL execution

Q: Which deployments are exposed to this issue?

The issue requires MySQL Group Replication using the XCom stack. An attacker must be connecting from a source address permitted by group_replication_ip_allowlist.

Q: Does a default configuration allow attacks from the public Internet?

No. The default AUTOMATIC setting permits localhost and private subnets detected on active host interfaces; reachability beyond local or private networks requires a non-default configuration that permits such addresses.

Q: Does an attacker need MySQL credentials or Group Replication membership?

No. A permitted source can execute arbitrary SQL through the XCom replication listener without a MySQL account or group membership.

Q: How can I determine whether public sources may be able to reach the affected listener?

Inspect group_replication_ip_allowlist. Public exposure is possible when it has been explicitly configured to allow arbitrary, including public, addresses.

Published Sep 15, 2026

Updated

Affected Software

2 affected components

Oracle MySQL Server>=8.4.0<=8.4.10, >=9.7.0<=9.7.1

MySQL Cluster>=8.0.0<=8.0.47, >=8.4.0<=8.4.10, >=9.7.0<=9.7.1

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue requires MySQL Group Replication using the XCom stack. An attacker must be connecting from a source address permitted by group_replication_ip_allowlist.

Does a default configuration allow attacks from the public Internet?

No. The default AUTOMATIC setting permits localhost and private subnets detected on active host interfaces; reachability beyond local or private networks requires a non-default configuration that permits such addresses.

Does an attacker need MySQL credentials or Group Replication membership?

No. A permitted source can execute arbitrary SQL through the XCom replication listener without a MySQL account or group membership.

How can I determine whether public sources may be able to reach the affected listener?

Inspect group_replication_ip_allowlist. Public exposure is possible when it has been explicitly configured to allow arbitrary, including public, addresses.