---
id: "CVE-2026-101770"
kind: "vulnerability"
aliases: ["CVE-2026-101770"]
title: "MySQL Server and Cluster: client programs flaw allows full server takeover"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mysql", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "unaffected-version"]
published_at: "2026-10-20T22:18:32+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:06:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101770", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# MySQL Server and Cluster: client programs flaw allows full server takeover

A flaw in the MySQL Server and MySQL Cluster client programs lets an unauthenticated attacker with network access compromise the server. The sources say a successful attack can result in takeover of the MySQL Server or MySQL Cluster.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `mysqld --version` on each database host and compare against the affected ranges: 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, 26.7.0 to 26.7.1, and 8.0.0 to 8.0.49 for MySQL Cluster.
- Check whether the database port is reachable from networks other than the application hosts.

## Fix

- Move MySQL Server and MySQL Cluster to a patched release from Oracle's July 2026 Critical Patch Update; the exact fixed versions are unknown from these sources.
- Restrict network access to the database port until patched.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101770

## From the sources

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_