{"id":"CVE-2026-101768","kind":"vulnerability","aliases":["CVE-2026-101768"],"related":[],"title":"MySQL Connector/J: unauthenticated network attacker can take over the connector","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle's MySQL Connector/J, the Java JDBC driver for MySQL, has a flaw that an unauthenticated attacker can reach over HTTP from the network. Successful exploitation can lead to full takeover of the connector with high confidentiality, integrity and availability impact.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["connector-j","java","jdbc","mysql","package"],"not_affected_if":["other-connector-version"],"how_to_check":"- Check the Connector/J version in the application's dependencies, for example `mvn dependency:list | grep mysql-connector`\n- Confirm whether the version in use is `26.7.0`, the affected version named by the source","fix":"- Move Connector/J past `26.7.0` to the fixed release named in Oracle's advisory (unknown in the sources)\n- Rebuild and redeploy services that bundle the driver","status":"open","published_at":"2026-10-20T22:18:32+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:06:22+00:00","updated_at":"2026-10-25T03:06:22+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:06:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move Connector/J past `26.7.0` to the fixed release named in Oracle's advisory (unknown in the sources)\n- Rebuild and redeploy services that bundle the driver","reach":"network","title":"MySQL Connector/J: unauthenticated network attacker can take over the connector","impact":"high","summary":"Oracle's MySQL Connector/J, the Java JDBC driver for MySQL, has a flaw that an unauthenticated attacker can reach over HTTP from the network. Successful exploitation can lead to full takeover of the connector with high confidentiality, integrity and availability impact.","category":"package","nicknames":[],"who_cares":["java","mysql","connector-j","jdbc"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker takes over the connector and affects confidentiality, integrity and availability","analyst_note":"Find Oracle's advisory and the fixed Connector/J version, and the exact attack surface in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-101768.","how_to_check":"- Check the Connector/J version in the application's dependencies, for example `mvn dependency:list | grep mysql-connector`\n- Confirm whether the version in use is `26.7.0`, the affected version named by the source","needs_analyst":true,"not_affected_if":["other-connector-version"],"who_is_affected":"The sources name only the supported version `26.7.0` of Connector/J and say the attack is reached over HTTP by an unauthenticated attacker. Teams whose Java services bundle that driver version and accept HTTP traffic from untrusted networks should look first. The sources do not say which code path reaches the driver, so teams that do not use this version can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":3434,"output_tokens":635,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101768':13A,16A '-2026':12A,15A '/av':126C '26.7.0':83C '3.1':113C,125C '8.1':116C 'access':93C 'affect':81C 'allow':88C 'attack':5A,40B,90C,101C 'avail':63B,120C 'base':114C 'compon':74C 'compromis':97C 'confidenti':60B,117C 'connector':10A,18B,57B,69C,99C,111C 'connector-j':17B 'connector/j':2A,27B,75C 'cve':11A,14A 'cvss':112C,122C,124C 'difficult':84C 'driver':31B 'exploit':49B,86C 'flaw':36B 'full':53B 'h':134C 'h/a':133C 'h/i':132C 'h/pr':128C 'high':59B 'http':44B,95C 'impact':64B,121C 'integr':61B,118C 'j':19B 'java':20B,29B 'jdbc':21B,30B 'lead':51B 'mysql':1A,22B,26B,33B,68C,73C,98C,110C 'n/ac':127C 'n/s':130C 'n/ui':129C 'network':4A,47B,92C 'oracl':24B,72C 'packag':23B 'product':70C 'reach':42B 'result':106C 'score':115C 'success':48B,100C 'support':77C 'take':7A 'takeov':54B,108C 'u/c':131C 'unauthent':3A,39B,89C 'vector':123C 'version':78C 'via':94C 'vulner':65C,87C,104C","nicknames":[],"mitigations":[],"who_affected":"The sources name only the supported version `26.7.0` of Connector/J and say the attack is reached over HTTP by an unauthenticated attacker. Teams whose Java services bundle that driver version and accept HTTP traffic from untrusted networks should look first. The sources do not say which code path reaches the driver, so teams that do not use this version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","severity":null,"published_at":"2026-10-20T22:18:32+00:00","modified_at":"2026-10-22T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}