{"id":"CVE-2026-101633","kind":"vulnerability","aliases":["CVE-2026-101633"],"related":[],"title":"MySQL Router: low-privilege network attacker can read some router data","description":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","summary":"MySQL Router 26.7.0 has a flaw in its General component reachable over HTTPS. An attacker with a low-privilege account on the network can read a subset of data the router exposes.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","mysql-router","package","self-hosted"],"not_affected_if":["no-network-exposure","other-mysql-router-versions"],"how_to_check":"- Run `mysqlrouter --version` and confirm whether it reports `26.7.0`.\n- Check whether the router's HTTPS/REST endpoints are reachable from the network.","fix":"- Upgrade MySQL Router to a release newer than `26.7.0` once Oracle publishes a fixed version (unknown from sources).\n- Restrict network access to the router's HTTPS interface until patched.","status":"open","published_at":"2026-10-20T22:18:17+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:39:12+00:00","updated_at":"2026-10-25T04:39:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:39:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySQL Router to a release newer than `26.7.0` once Oracle publishes a fixed version (unknown from sources).\n- Restrict network access to the router's HTTPS interface until patched.","reach":"network","title":"MySQL Router: low-privilege network attacker can read some router data","impact":"low","summary":"MySQL Router 26.7.0 has a flaw in its General component reachable over HTTPS. An attacker with a low-privilege account on the network can read a subset of data the router exposes.","category":"package","nicknames":[],"who_cares":["mysql","mysql-router","database","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads a subset of router-accessible data over HTTPS.","analyst_note":"","how_to_check":"- Run `mysqlrouter --version` and confirm whether it reports `26.7.0`.\n- Check whether the router's HTTPS/REST endpoints are reachable from the network.","needs_analyst":false,"not_affected_if":["other-mysql-router-versions","no-network-exposure"],"who_is_affected":"Teams running MySQL Router 26.7.0 with its HTTPS interface reachable by users or hosts holding low-privilege accounts. Deployments where the router is only reachable from trusted hosts or not running this version can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000595,"input_tokens":3427,"output_tokens":504,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101633':15A,18A '-2026':14A,17A '/av':127C '26.7.0':30B,80C '3.1':117C,126C '4.3':120C 'access':90C,107C,114C 'account':48B 'affect':78C 'allow':84C 'attack':7A,42B,87C,98C 'base':118C 'compon':37B,70C 'compromis':94C 'confidenti':121C 'cve':13A,16A 'cvss':116C,123C,125C 'data':12A,57B,115C 'databas':19B 'easili':81C 'exploit':82C 'expos':60B 'flaw':33B 'general':36B,72C 'host':27B 'https':40B,92C 'impact':122C 'l/i':133C 'l/pr':129C 'l/ui':130C 'low':4A,46B,85C 'low-privileg':3A,45B 'mysql':1A,20B,22B,28B,64C,69C,95C,112C 'mysql-rout':21B 'n':135C 'n/a':134C 'n/ac':128C 'n/s':131C 'network':6A,51B,89C 'oracl':68C 'packag':24B 'privileg':5A,47B,86C 'product':66C 'reachabl':38B 'read':9A,53B,106C 'result':103C 'router':2A,11A,23B,29B,59B,65C,71C,96C,113C 'score':119C 'self':26B 'self-host':25B 'subset':55B,110C 'success':97C 'support':74C 'u/c':132C 'unauthor':105C 'vector':124C 'version':75C 'via':91C 'vulner':61C,83C,101C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Router 26.7.0 with its HTTPS interface reachable by users or hosts holding low-privilege accounts. Deployments where the router is only reachable from trusted hosts or not running this version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101633","severity":null,"published_at":"2026-10-20T22:18:17+00:00","modified_at":"2026-10-21T19:16:52+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}