---
id: "CVE-2026-101769"
kind: "vulnerability"
aliases: ["CVE-2026-101769"]
title: "MySQL Cluster: unauthenticated network flaw allows crash and data changes"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mysql", "mysql-cluster", "package", "self-hosted"]
not_affected_if: ["no-network-exposure", "other-mysql-versions"]
published_at: "2026-10-20T22:18:32+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:38:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101769", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# MySQL Cluster: unauthenticated network flaw allows crash and data changes

MySQL Cluster versions 26.7.0 through 26.7.1 have a flaw in the General component that an unauthenticated attacker can reach over TCP. Successful exploitation can crash or hang the cluster and gives partial read, insert, update and delete access to some data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `ndb_mgm --version` or `mysqld --version` on cluster nodes and compare against `26.7.0` and `26.7.1`
- Check the installed MySQL Cluster package version with your OS package manager
- unknown for any further configuration check, the sources do not say

## Fix

- Upgrade MySQL Cluster to a release later than `26.7.1` once Oracle publishes one; the sources do not name the fixed version
- Restrict TCP access to cluster ports to trusted hosts until patched

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101769

## From the sources

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).  Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Cluster accessible data and  unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_