---
id: "CVE-2026-101626"
kind: "vulnerability"
aliases: ["CVE-2026-101626"]
title: "MySQL Connector/NET: unauthenticated network attacker can read connector data"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["connector-net", "dotnet", "mysql", "package"]
not_affected_if: ["not-using-connector-net"]
published_at: "2026-10-20T22:18:16+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:08:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101626", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# MySQL Connector/NET: unauthenticated network attacker can read connector data

Oracle's MySQL Connector/NET 26.7.0 has a flaw that a remote, unauthenticated attacker can reach over the network with some difficulty. A successful attack can expose data the connector can access, with a CVSS 3.1 score of 5.9 that counts only confidentiality impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Connector/NET version in the application's dependencies, for example with `dotnet list package` and look for `MySql.Data` or `MySqlConnector`, and compare against the version in the advisory.
- unknown whether the source gives a version-specific check beyond the affected version `26.7.0`.

## Fix

- Move Connector/NET off the affected release `26.7.0` to a fixed release listed in Oracle's advisory (version not stated in the sources).
- unknown for specific fixed version number.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101626

## From the sources

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_