{"id":"CVE-2026-101677","kind":"vulnerability","aliases":["CVE-2026-101677"],"related":[],"title":"MySQL Connector/J 26.7.0: unauthenticated network attacker can alter some data","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).","summary":"Oracle's MySQL Connector/J 26.7.0 has a flaw that an unauthenticated attacker with network access can trigger, with a person's action needed to complete it. A successful attack can allow unauthorized update, insert or delete of some data the connector can reach.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["connector-j","java","mysql","package"],"not_affected_if":["unknown"],"how_to_check":"- Check the Connector/J version in the project's dependency file or the `mysql-connector-j` jar on the classpath.\n- Confirm whether the version is `26.7.0`, as listed in the description.","fix":"- Upgrade Connector/J to a version newer than `26.7.0` (the fixed version is unknown from the sources).","status":"open","published_at":"2026-10-20T22:18:22+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:39:11+00:00","updated_at":"2026-10-25T04:39:11+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:39:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Connector/J to a version newer than `26.7.0` (the fixed version is unknown from the sources).","reach":"network","title":"MySQL Connector/J 26.7.0: unauthenticated network attacker can alter some data","impact":"medium","summary":"Oracle's MySQL Connector/J 26.7.0 has a flaw that an unauthenticated attacker with network access can trigger, with a person's action needed to complete it. A successful attack can allow unauthorized update, insert or delete of some data the connector can reach.","category":"package","nicknames":[],"who_cares":["mysql","java","connector-j"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthorized changes to some data the connector can access","analyst_note":"Find the fixed Connector/J version and the exact connection or data path from Oracle's MySQL security advisory (the NVD page is the only source here).","how_to_check":"- Check the Connector/J version in the project's dependency file or the `mysql-connector-j` jar on the classpath.\n- Confirm whether the version is `26.7.0`, as listed in the description.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Applications that bundle or depend on MySQL Connector/J 26.7.0 and connect to MySQL over the network are the ones to look at. The sources do not say which connection settings or data paths are needed to reach the flaw, so teams on other Connector/J versions can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3463,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101677':13A,16A '-2026':12A,15A '/av':145C '26.7.0':3A,27B,84C '3.1':135C,144C '4.3':138C 'access':37B,93C,126C,132C 'action':44B 'affect':82C 'allow':53B,88C 'alter':8A 'attack':6A,34B,51B,90C,102C,112C,114C 'base':136C 'complet':47B 'compon':75C 'compromis':98C 'connector':18B,63B,70C,100C,131C 'connector-j':17B 'connector/j':2A,26B,76C 'cve':11A,14A 'cvss':134C,141C,143C 'data':10A,61B,133C 'delet':58B,125C 'easili':85C 'exploit':86C 'flaw':30B 'human':104C 'impact':140C 'insert':56B,123C 'integr':139C 'interact':105C 'j':19B 'java':20B 'l/a':152C 'l/pr':147C 'multipl':95C 'mysql':1A,21B,25B,69C,74C,99C,130C 'n':153C 'n/ac':146C 'n/i':151C 'n/ui':148C 'need':45B 'network':5A,36B,92C 'oracl':23B,73C 'packag':22B 'person':42B,108C 'product':71C 'protocol':96C 'r/s':149C 'reach':65B 'requir':103C 'result':119C 'score':137C 'success':50B,101C,113C 'support':78C 'trigger':39B 'u/c':150C 'unauthent':4A,33B,89C 'unauthor':54B,121C 'updat':55B,122C 'vector':142C 'version':79C 'via':94C 'vulner':66C,87C,117C","nicknames":[],"mitigations":[],"who_affected":"Applications that bundle or depend on MySQL Connector/J 26.7.0 and connect to MySQL over the network are the ones to look at. The sources do not say which connection settings or data paths are needed to reach the flaw, so teams on other Connector/J versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101677","severity":null,"published_at":"2026-10-20T22:18:22+00:00","modified_at":"2026-10-21T21:17:35+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}