---
id: "CVE-2026-101722"
kind: "vulnerability"
aliases: ["CVE-2026-101722"]
title: "MySQL Server: connection handling flaw leaks a subset of stored data"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mysql", "mysql-cluster", "package", "self-hosted"]
not_affected_if: ["no-network-access", "unaffected-version"]
published_at: "2026-10-20T22:18:26+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T04:39:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101722", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# MySQL Server: connection handling flaw leaks a subset of stored data

A flaw in how MySQL Server and MySQL Cluster handle connections lets a low-privileged account reach data it should not read. The sources rate it as a confidentiality issue only, with no integrity or availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `SELECT VERSION();` in the MySQL client to see whether the server is `9.7.0` through `9.7.3` or `26.7.0` through `26.7.1`.
- For MySQL Cluster, check the `ndb_mgmd --version` output against the same version ranges.

## Fix

- Upgrade MySQL Server and MySQL Cluster to a release after the affected ranges (`9.7.3` and `26.7.1` are the last affected builds; the fixed version is unknown from the sources).
- Restrict network access to the MySQL port until patched.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101722

## From the sources

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling).  Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_