{"id":"CVE-2026-101770","kind":"vulnerability","aliases":["CVE-2026-101770"],"related":[],"title":"MySQL Server and Cluster: client programs flaw allows full server takeover","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"A flaw in the MySQL Server and MySQL Cluster client programs lets an unauthenticated attacker with network access compromise the server. The sources say a successful attack can result in takeover of the MySQL Server or MySQL Cluster.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","package","self-hosted"],"not_affected_if":["managed-hosting","unaffected-version"],"how_to_check":"- Run `mysqld --version` on each database host and compare against the affected ranges: 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, 26.7.0 to 26.7.1, and 8.0.0 to 8.0.49 for MySQL Cluster.\n- Check whether the database port is reachable from networks other than the application hosts.","fix":"- Move MySQL Server and MySQL Cluster to a patched release from Oracle's July 2026 Critical Patch Update; the exact fixed versions are unknown from these sources.\n- Restrict network access to the database port until patched.","status":"open","published_at":"2026-10-20T22:18:32+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:06:22+00:00","updated_at":"2026-10-25T03:06:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:06:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move MySQL Server and MySQL Cluster to a patched release from Oracle's July 2026 Critical Patch Update; the exact fixed versions are unknown from these sources.\n- Restrict network access to the database port until patched.","reach":"network","title":"MySQL Server and Cluster: client programs flaw allows full server takeover","impact":"high","summary":"A flaw in the MySQL Server and MySQL Cluster client programs lets an unauthenticated attacker with network access compromise the server. The sources say a successful attack can result in takeover of the MySQL Server or MySQL Cluster.","category":"package","nicknames":[],"who_cares":["mysql","database","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the MySQL server and its data","analyst_note":"Check Oracle's advisory for the fixed versions and the affected client program code path; the sources give only NVD and the CVSS vector.","how_to_check":"- Run `mysqld --version` on each database host and compare against the affected ranges: 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, 26.7.0 to 26.7.1, and 8.0.0 to 8.0.49 for MySQL Cluster.\n- Check whether the database port is reachable from networks other than the application hosts.","needs_analyst":true,"not_affected_if":["managed-hosting","unaffected-version"],"who_is_affected":"Teams running MySQL Server or MySQL Cluster in the listed version ranges, especially where the database is reachable over the network. The sources do not say which client program code path is involved, so teams on unaffected versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":3564,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101770':14A,17A '-2026':13A,16A '/av':148C '26.7.0':88C,99C '26.7.1':89C,100C '3.1':135C,147C '8.0.0':92C '8.0.49':93C '8.1':138C '8.4.0':84C,94C '8.4.12':85C,95C '9.7.0':86C,96C '9.7.3':87C,97C 'access':41B,110C 'affect':80C 'allow':8A,105C 'attack':38B,50B,107C,121C 'avail':142C 'base':136C 'client':5A,33B,74C 'cluster':4A,32B,61B,68C,91C,119C,133C 'compon':73C 'compromis':42B,115C 'confidenti':139C 'cve':12A,15A 'cvss':134C,144C,146C 'databas':18B 'difficult':101C 'exploit':103C 'flaw':7A,25B 'full':9A 'h':156C 'h/a':155C 'h/i':154C 'h/pr':150C 'host':23B 'impact':143C 'integr':140C 'let':35B 'multipl':112C 'mysql':1A,19B,28B,31B,57B,60B,65C,67C,72C,82C,90C,116C,118C,130C,132C 'n/ac':149C 'n/s':152C 'n/ui':151C 'network':40B,109C 'oracl':71C 'packag':20B 'product':69C 'program':6A,34B,75C 'protocol':113C 'result':52B,126C 'say':47B 'score':137C 'self':22B 'self-host':21B 'server':2A,10A,29B,44B,58B,66C,83C,117C,131C 'sourc':46B 'success':49B,120C 'support':76C 'takeov':11A,54B,128C 'u/c':153C 'unauthent':37B,106C 'vector':145C 'version':77C 'via':111C 'vulner':62C,104C,124C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Server or MySQL Cluster in the listed version ranges, especially where the database is reachable over the network. The sources do not say which client program code path is involved, so teams on unaffected versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101770","severity":null,"published_at":"2026-10-20T22:18:32+00:00","modified_at":"2026-10-22T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}