{"id":"CVE-2026-101632","kind":"vulnerability","aliases":["CVE-2026-101632"],"related":[],"title":"MySQL Router: unauthenticated flaw leaks a subset of router data","description":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).","summary":"A flaw in the General component of MySQL Router 26.7.0 lets an unauthenticated attacker reach the router over HTTPS and read a subset of the data it can access. Exploitation needs a person other than the attacker to take an action.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","mysql-router","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Run `mysqlrouter --version` and compare against `26.7.0`\n- unknown","fix":"- Upgrade MySQL Router past `26.7.0` using the fixed release from Oracle's advisory\n- unknown","status":"open","published_at":"2026-10-20T22:18:17+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:39:14+00:00","updated_at":"2026-10-25T04:39:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:39:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySQL Router past `26.7.0` using the fixed release from Oracle's advisory\n- unknown","reach":"network","title":"MySQL Router: unauthenticated flaw leaks a subset of router data","impact":"low","summary":"A flaw in the General component of MySQL Router 26.7.0 lets an unauthenticated attacker reach the router over HTTPS and read a subset of the data it can access. Exploitation needs a person other than the attacker to take an action.","category":"package","nicknames":[],"who_cares":["mysql","mysql-router","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads a subset of MySQL Router accessible data","analyst_note":"","how_to_check":"- Run `mysqlrouter --version` and compare against `26.7.0`\n- unknown","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Teams running MySQL Router 26.7.0 that expose its HTTPS interface to a network the attacker can reach. The sources do not say which deployments are exposed by default, so the reach beyond the stated network access is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000567,"input_tokens":3450,"output_tokens":443,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101632':13A,16A '-2026':12A,15A '/av':143C '26.7.0':34B,85C '3.1':133C,142C '4.3':136C 'access':53B,94C,123C,130C 'action':65B 'affect':83C 'allow':89C 'attack':38B,61B,91C,102C,112C,114C 'base':134C 'compon':30B,75C 'compromis':98C 'confidenti':137C 'cve':11A,14A 'cvss':132C,139C,141C 'data':10A,50B,131C 'easili':86C 'exploit':54B,87C 'flaw':4A,26B 'general':29B,77C 'host':24B 'https':43B,96C 'human':104C 'impact':138C 'interact':105C 'l/i':149C 'l/pr':145C 'leak':5A 'let':35B 'mysql':1A,17B,19B,32B,69C,74C,99C,128C 'mysql-rout':18B 'n':151C 'n/a':150C 'n/ac':144C 'n/ui':146C 'need':55B 'network':93C 'oracl':73C 'packag':21B 'person':57B,108C 'product':71C 'r/s':147C 'reach':39B 'read':45B,122C 'requir':103C 'result':119C 'router':2A,9A,20B,33B,41B,70C,76C,100C,129C 'score':135C 'self':23B 'self-host':22B 'subset':7A,47B,126C 'success':101C,113C 'support':79C 'take':63B 'u/c':148C 'unauthent':3A,37B,90C 'unauthor':121C 'vector':140C 'version':80C 'via':95C 'vulner':66C,88C,117C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Router 26.7.0 that expose its HTTPS interface to a network the attacker can reach. The sources do not say which deployments are exposed by default, so the reach beyond the stated network access is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101632","severity":null,"published_at":"2026-10-20T22:18:17+00:00","modified_at":"2026-10-21T19:16:51+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}