How do I check whether I am affected by CVE-2026-101633?

- Run `mysqlrouter --version` and confirm whether it reports `26.7.0`. - Check whether the router's HTTPS/REST endpoints are reachable from the network.

What is the fix for CVE-2026-101633?

- Upgrade MySQL Router to a release newer than `26.7.0` once Oracle publishes a fixed version (unknown from sources). - Restrict network access to the router's HTTPS interface until patched.

Who is not affected by CVE-2026-101633?

Not affected if: no-network-exposure, other-mysql-router-versions.

Live › vulnerability › CVE-2026-101633

Go to dashboard

medium4.3Package

MySQL Router: low-privilege network attacker can read some router data

MySQL Router 26.7.0 has a flaw in its General component reachable over HTTPS. An attacker with a low-privilege account on the network can read a subset of data the router exposes.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

4.3

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 21, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker reads a subset of router-accessible data over HTTPS.
CVSS said: 4.3. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

Teams running MySQL Router 26.7.0 with its HTTPS interface reachable by users or hosts holding low-privilege accounts. Deployments where the router is only reachable from trusted hosts or not running this version can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-101633

Go to dashboard

medium4.3Package

MySQL Router: low-privilege network attacker can read some router data

MySQL Router 26.7.0 has a flaw in its General component reachable over HTTPS. An attacker with a low-privilege account on the network can read a subset of data the router exposes.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

4.3

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 21, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker reads a subset of router-accessible data over HTTPS.
CVSS said: 4.3. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

MySQL Router: low-privilege network attacker can read some router data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

MySQL Router: low-privilege network attacker can read some router data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources