{"id":"CVE-2026-101625","kind":"vulnerability","aliases":["CVE-2026-101625"],"related":[],"title":"MySQL Connector/Net: unauthenticated user can read a subset of data","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).","summary":"Oracle's MySQL Connector/Net 26.7.0 has a flaw that lets a remote, unauthenticated attacker read a subset of data the connector can access. Exploitation needs a person other than the attacker to take an action.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["connector-net","dotnet","mysql","package"],"not_affected_if":["unknown"],"how_to_check":"- Run `unknown` to find the installed Connector/Net version in the application's package manifest or NuGet lockfile\n- Check whether the application references MySQL.Data or MySqlConnector at version `26.7.0`","fix":"- Move MySQL Connector/Net off `26.7.0` to the patched release named in Oracle's advisory (version unknown from these sources)","status":"open","published_at":"2026-10-20T22:18:16+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:39:15+00:00","updated_at":"2026-10-25T04:39:15+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:39:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move MySQL Connector/Net off `26.7.0` to the patched release named in Oracle's advisory (version unknown from these sources)","reach":"network","title":"MySQL Connector/Net: unauthenticated user can read a subset of data","impact":"low","summary":"Oracle's MySQL Connector/Net 26.7.0 has a flaw that lets a remote, unauthenticated attacker read a subset of data the connector can access. Exploitation needs a person other than the attacker to take an action.","category":"package","nicknames":[],"who_cares":["dotnet","mysql","connector-net"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker reads a subset of data accessible through the connector","analyst_note":"Find Oracle's MySQL Connector/Net advisory and the patched version number for 26.7.0, plus the specific protocol and trigger.","how_to_check":"- Run `unknown` to find the installed Connector/Net version in the application's package manifest or NuGet lockfile\n- Check whether the application references MySQL.Data or MySqlConnector at version `26.7.0`","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Applications built on .NET that use MySQL Connector/Net version 26.7.0 to reach a MySQL database. The sources do not describe the exact data path or configuration that makes an application reachable, so the exposure of a given deployment is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000614,"input_tokens":3463,"output_tokens":536,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101625':13A,16A '-2026':12A,15A '/av':135C '26.7.0':27B,76C '3.1':125C,134C '4.3':128C 'access':45B,85C,115C,122C 'action':57B 'affect':74C 'allow':80C 'attack':36B,53B,82C,94C,104C,106C 'base':126C 'compon':67C 'compromis':90C 'confidenti':129C 'connector':18B,43B,62C,92C,121C 'connector-net':17B 'connector/net':2A,26B,68C 'cve':11A,14A 'cvss':124C,131C,133C 'data':10A,41B,123C 'dotnet':20B 'easili':77C 'exploit':46B,78C 'flaw':30B 'human':96C 'impact':130C 'interact':97C 'l/i':141C 'l/pr':137C 'let':32B 'multipl':87C 'mysql':1A,21B,25B,61C,66C,91C,120C 'n':143C 'n/a':142C 'n/ac':136C 'n/ui':138C 'need':47B 'net':19B 'network':84C 'oracl':23B,65C 'packag':22B 'person':49B,100C 'product':63C 'protocol':88C 'r/s':139C 'read':6A,37B,114C 'remot':34B 'requir':95C 'result':111C 'score':127C 'subset':8A,39B,118C 'success':93C,105C 'support':70C 'take':55B 'u/c':140C 'unauthent':3A,35B,81C 'unauthor':113C 'user':4A 'vector':132C 'version':71C 'via':86C 'vulner':58C,79C,109C","nicknames":[],"mitigations":[],"who_affected":"Applications built on .NET that use MySQL Connector/Net version 26.7.0 to reach a MySQL database. The sources do not describe the exact data path or configuration that makes an application reachable, so the exposure of a given deployment is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101625","severity":null,"published_at":"2026-10-20T22:18:16+00:00","modified_at":"2026-10-21T19:16:51+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}