---
id: "CVE-2026-101768"
kind: "vulnerability"
aliases: ["CVE-2026-101768"]
title: "MySQL Connector/J: unauthenticated network attacker can take over the connector"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["connector-j", "java", "jdbc", "mysql", "package"]
not_affected_if: ["other-connector-version"]
published_at: "2026-10-20T22:18:32+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:06:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101768", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# MySQL Connector/J: unauthenticated network attacker can take over the connector

Oracle's MySQL Connector/J, the Java JDBC driver for MySQL, has a flaw that an unauthenticated attacker can reach over HTTP from the network. Successful exploitation can lead to full takeover of the connector with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Connector/J version in the application's dependencies, for example `mvn dependency:list | grep mysql-connector`
- Confirm whether the version in use is `26.7.0`, the affected version named by the source

## Fix

- Move Connector/J past `26.7.0` to the fixed release named in Oracle's advisory (unknown in the sources)
- Rebuild and redeploy services that bundle the driver

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101768

## From the sources

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_