{"id":"CVE-2026-101513","kind":"vulnerability","aliases":["CVE-2026-101513"],"related":[],"title":"MySQL Cluster InnoDB flaw lets physical attackers crash the database","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.37. Difficult to exploit vulnerability allows physical access to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 3.8 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).","summary":"A flaw in the InnoDB storage component of MySQL Cluster versions 8.0.0 through 8.0.37 can be used to cause a hang or repeatable crash. The attacker needs physical access and high privileges, and the impact is denial of service only.","severity":"low","cvss":3.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["innodb","mysql","mysql-cluster","package","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"- Run `mysql -V` or `SELECT VERSION();` and compare against the affected range 8.0.0 to 8.0.37\n- Confirm whether the deployment runs the MySQL Cluster (NDB) product, which the advisory names","fix":"- Upgrade MySQL Cluster to a release after `8.0.37` per Oracle's Critical Patch Update for the relevant quarter","status":"open","published_at":"2026-10-20T22:18:00+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:43:17+00:00","updated_at":"2026-10-25T04:43:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:43:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySQL Cluster to a release after `8.0.37` per Oracle's Critical Patch Update for the relevant quarter","reach":"local","title":"MySQL Cluster InnoDB flaw lets physical attackers crash the database","impact":"low","summary":"A flaw in the InnoDB storage component of MySQL Cluster versions 8.0.0 through 8.0.37 can be used to cause a hang or repeatable crash. The attacker needs physical access and high privileges, and the impact is denial of service only.","category":"package","nicknames":[],"who_cares":["mysql","mysql-cluster","innodb","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Database service hangs or crashes repeatedly, causing denial of service","analyst_note":"","how_to_check":"- Run `mysql -V` or `SELECT VERSION();` and compare against the affected range 8.0.0 to 8.0.37\n- Confirm whether the deployment runs the MySQL Cluster (NDB) product, which the advisory names","needs_analyst":false,"not_affected_if":["managed-hosting","default-config"],"who_is_affected":"Teams running MySQL Cluster 8.0.0 through 8.0.37 on hardware an attacker could physically reach. The sources describe a hard-to-exploit local availability issue, so remote-only deployments face lower practical risk but should still patch on normal schedule.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000613,"input_tokens":3442,"output_tokens":537,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101513':13A,16A '-2026':12A,15A '/av':129C '3.1':119C,128C '3.8':122C '8.0.0':37B,82C '8.0.37':39B,83C 'abil':104C 'access':54B,90C 'affect':80C 'allow':88C 'attack':7A,51B,96C 'avail':123C 'base':120C 'caus':44B,106C 'cluster':2A,21B,35B,69C,94C,117C 'complet':113C 'compon':32B,74C 'compromis':92C 'crash':8A,49B,112C 'cve':11A,14A 'cvss':118C,125C,127C 'databas':10A 'denial':62B 'difficult':84C 'dos':114C 'exploit':86C 'flaw':4A,27B 'frequent':110C 'h':137C 'h/pr':131C 'h/ui':132C 'hang':46B,108C 'high':56B 'host':25B 'impact':60B,124C 'innodb':3A,17B,30B,75C 'let':5A 'mysql':1A,18B,20B,34B,68C,73C,93C,116C 'mysql-clust':19B 'n/a':136C 'n/i':135C 'n/s':133C 'need':52B 'oracl':72C 'p/ac':130C 'packag':22B 'physic':6A,53B,89C 'privileg':57B 'product':70C 'repeat':48B,111C 'result':101C 'score':121C 'self':24B 'self-host':23B 'servic':64B 'storag':31B 'success':95C 'support':76C 'u/c':134C 'unauthor':103C 'use':42B 'vector':126C 'version':36B,77C 'vulner':65C,87C,99C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Cluster 8.0.0 through 8.0.37 on hardware an attacker could physically reach. The sources describe a hard-to-exploit local availability issue, so remote-only deployments face lower practical risk but should still patch on normal schedule.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101513","severity":null,"published_at":"2026-10-20T22:18:00+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}