Live › vulnerability › CVE-2026-101722
Go to dashboardA flaw in how MySQL Server and MySQL Cluster handle connections lets a low-privileged account reach data it should not read. The sources rate it as a confidentiality issue only, with no integrity or availability impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running MySQL Server or MySQL Cluster in the affected version ranges, especially where low-privileged accounts can connect over the network via multiple protocols. Systems on unaffected versions or with MySQL reachable only from a tightly limited network can skip urgent action.
No product ranges from the sources yet.
SELECT VERSION(); in the MySQL client to see whether the server is 9.7.0 through 9.7.3 or 26.7.0 through 26.7.1.ndb_mgmd --version output against the same version ranges.9.7.3 and 26.7.1 are the last affected builds; the fixed version is unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101722")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.