---
id: "CVE-2026-101633"
kind: "vulnerability"
aliases: ["CVE-2026-101633"]
title: "MySQL Router: low-privilege network attacker can read some router data"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mysql", "mysql-router", "package", "self-hosted"]
not_affected_if: ["no-network-exposure", "other-mysql-router-versions"]
published_at: "2026-10-20T22:18:17+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:39:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101633", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# MySQL Router: low-privilege network attacker can read some router data

MySQL Router 26.7.0 has a flaw in its General component reachable over HTTPS. An attacker with a low-privilege account on the network can read a subset of data the router exposes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `mysqlrouter --version` and confirm whether it reports `26.7.0`.
- Check whether the router's HTTPS/REST endpoints are reachable from the network.

## Fix

- Upgrade MySQL Router to a release newer than `26.7.0` once Oracle publishes a fixed version (unknown from sources).
- Restrict network access to the router's HTTPS interface until patched.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101633

## From the sources

Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_