Live › vulnerability › CVE-2026-101631
Go to dashboardMySQL Router version 26.7.0 has a flaw in its General component that is reachable over HTTPS. A remote, unauthenticated attacker who gets a user to take an action can read and modify data the router can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running MySQL Router 26.7.0 where the router's HTTPS endpoint can be reached by an attacker, and where a person can be induced to interact with the attack path. Deployments that do not run this version, or keep the router off untrusted networks, are less exposed. unknown for which exact deployment modes are affected.
No product ranges from the sources yet.
mysqlrouter --version on each host that runs MySQL Router and compare against 26.7.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101631")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.