{"id":"CVE-2026-101626","kind":"vulnerability","aliases":["CVE-2026-101626"],"related":[],"title":"MySQL Connector/NET: unauthenticated network attacker can read connector data","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle's MySQL Connector/NET 26.7.0 has a flaw that a remote, unauthenticated attacker can reach over the network with some difficulty. A successful attack can expose data the connector can access, with a CVSS 3.1 score of 5.9 that counts only confidentiality impact.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["connector-net","dotnet","mysql","package"],"not_affected_if":["not-using-connector-net"],"how_to_check":"- Check the installed Connector/NET version in the application's dependencies, for example with `dotnet list package` and look for `MySql.Data` or `MySqlConnector`, and compare against the version in the advisory.\n- unknown whether the source gives a version-specific check beyond the affected version `26.7.0`.","fix":"- Move Connector/NET off the affected release `26.7.0` to a fixed release listed in Oracle's advisory (version not stated in the sources).\n- unknown for specific fixed version number.","status":"open","published_at":"2026-10-20T22:18:16+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:08:32+00:00","updated_at":"2026-10-25T04:08:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:08:32Z","model":"claude-haiku-5-5","output":{"fix":"- Move Connector/NET off the affected release `26.7.0` to a fixed release listed in Oracle's advisory (version not stated in the sources).\n- unknown for specific fixed version number.","reach":"network","title":"MySQL Connector/NET: unauthenticated network attacker can read connector data","impact":"medium","summary":"Oracle's MySQL Connector/NET 26.7.0 has a flaw that a remote, unauthenticated attacker can reach over the network with some difficulty. A successful attack can expose data the connector can access, with a CVSS 3.1 score of 5.9 that counts only confidentiality impact.","category":"package","nicknames":[],"who_cares":["mysql","dotnet","connector-net"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads data accessible through the MySQL connector","analyst_note":"Check Oracle's Critical Patch Update advisory and NVD entry for fixed version numbers and the exact exposure path, since the sources give only the affected version.","how_to_check":"- Check the installed Connector/NET version in the application's dependencies, for example with `dotnet list package` and look for `MySql.Data` or `MySqlConnector`, and compare against the version in the advisory.\n- unknown whether the source gives a version-specific check beyond the affected version `26.7.0`.","needs_analyst":true,"not_affected_if":["not-using-connector-net"],"who_is_affected":"Teams that ship or run applications using MySQL Connector/NET version 26.7.0 to reach MySQL databases. The sources do not describe the configuration that makes an application exposed, so unknown. Teams not using Connector/NET can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":3447,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101626':12A,15A '-2026':11A,14A '/av':134C '26.7.0':26B,83C '3.1':56B,124C,133C '5.9':59B,127C 'access':52B,93C,110C,116C,121C 'affect':81C 'allow':88C 'attack':5A,34B,45B,90C,102C 'base':125C 'complet':115C 'compon':74C 'compromis':98C 'confidenti':63B,128C 'connector':8A,17B,50B,69C,100C,120C 'connector-net':16B 'connector/net':2A,25B,75C 'count':61B 'critic':112C 'cve':10A,13A 'cvss':55B,123C,130C,132C 'data':9A,48B,113C,122C 'difficult':84C 'difficulti':42B 'dotnet':19B 'exploit':86C 'expos':47B 'flaw':29B 'h/i':140C 'h/pr':136C 'impact':64B,129C 'multipl':95C 'mysql':1A,20B,24B,68C,73C,99C,119C 'n':142C 'n/a':141C 'n/ac':135C 'n/s':138C 'n/ui':137C 'net':18B 'network':4A,39B,92C 'oracl':22B,72C 'packag':21B 'product':70C 'protocol':96C 'reach':36B 'read':7A 'remot':32B 'result':107C 'score':57B,126C 'success':44B,101C 'support':77C 'u/c':139C 'unauthent':3A,33B,89C 'unauthor':109C 'vector':131C 'version':78C 'via':94C 'vulner':65C,87C,105C","nicknames":[],"mitigations":[],"who_affected":"Teams that ship or run applications using MySQL Connector/NET version 26.7.0 to reach MySQL databases. The sources do not describe the configuration that makes an application exposed, so unknown. Teams not using Connector/NET can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101626","severity":null,"published_at":"2026-10-20T22:18:16+00:00","modified_at":"2026-10-21T19:16:51+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}