---
id: "CVE-2026-101677"
kind: "vulnerability"
aliases: ["CVE-2026-101677"]
title: "MySQL Connector/J 26.7.0: unauthenticated network attacker can alter some data"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["connector-j", "java", "mysql", "package"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:18:22+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:39:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101677", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# MySQL Connector/J 26.7.0: unauthenticated network attacker can alter some data

Oracle's MySQL Connector/J 26.7.0 has a flaw that an unauthenticated attacker with network access can trigger, with a person's action needed to complete it. A successful attack can allow unauthorized update, insert or delete of some data the connector can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Connector/J version in the project's dependency file or the `mysql-connector-j` jar on the classpath.
- Confirm whether the version is `26.7.0`, as listed in the description.

## Fix

- Upgrade Connector/J to a version newer than `26.7.0` (the fixed version is unknown from the sources).

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101677

## From the sources

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_