{"id":"CVE-2026-101771","kind":"vulnerability","aliases":["CVE-2026-101771"],"related":[],"title":"MySQL Server and Cluster: client programs flaw allows full takeover over network","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"A flaw in the client programs component of MySQL Server and MySQL Cluster can be exploited over the network by an unauthenticated attacker. Successful attacks can result in takeover of the MySQL Server or MySQL Cluster.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","package","self-hosted"],"not_affected_if":["managed-hosting","network-isolated"],"how_to_check":"- Run `mysqld --version` on each database host and compare against the affected ranges: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1, and 8.0.0-8.0.49 for MySQL Cluster.\n- Check whether the server listens on the network with `ss -ltnp | grep mysql`.","fix":"- Upgrade MySQL Server and MySQL Cluster to a release outside the affected ranges; the exact fixed versions are unknown from the sources.\n- Restrict network access to the MySQL port until patched.","status":"open","published_at":"2026-10-20T22:18:32+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:06:20+00:00","updated_at":"2026-10-25T03:06:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:06:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySQL Server and MySQL Cluster to a release outside the affected ranges; the exact fixed versions are unknown from the sources.\n- Restrict network access to the MySQL port until patched.","reach":"network","title":"MySQL Server and Cluster: client programs flaw allows full takeover over network","impact":"high","summary":"A flaw in the client programs component of MySQL Server and MySQL Cluster can be exploited over the network by an unauthenticated attacker. Successful attacks can result in takeover of the MySQL Server or MySQL Cluster.","category":"package","nicknames":[],"who_cares":["mysql","self-hosted","database"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the MySQL server over the network","analyst_note":"Find the fixed versions and the vulnerable client program from the Oracle MySQL Critical Patch Update advisory for this release.","how_to_check":"- Run `mysqld --version` on each database host and compare against the affected ranges: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1, and 8.0.0-8.0.49 for MySQL Cluster.\n- Check whether the server listens on the network with `ss -ltnp | grep mysql`.","needs_analyst":true,"not_affected_if":["managed-hosting","network-isolated"],"who_is_affected":"Teams running MySQL Server or MySQL Cluster in the listed version ranges that accept network connections. Hosts where MySQL is bound to localhost or sits behind a firewall with no external access are less exposed. The sources do not state the exact fixed versions or the specific client program involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":3564,"output_tokens":622,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101771':15A,18A '-2026':14A,17A '/av':147C '26.7.0':87C,98C '26.7.1':88C,99C '3.1':134C,146C '8.0.0':91C '8.0.49':92C '8.1':137C '8.4.0':83C,93C '8.4.12':84C,94C '9.7.0':85C,95C '9.7.3':86C,96C 'access':109C 'affect':79C 'allow':8A,104C 'attack':47B,49B,106C,120C 'avail':141C 'base':135C 'client':5A,29B,73C 'cluster':4A,37B,60B,67C,90C,118C,132C 'compon':31B,72C 'compromis':114C 'confidenti':138C 'cve':13A,16A 'cvss':133C,143C,145C 'databas':19B 'difficult':100C 'exploit':40B,102C 'flaw':7A,26B 'full':9A 'h':155C 'h/a':154C 'h/i':153C 'h/pr':149C 'host':24B 'impact':142C 'integr':139C 'multipl':111C 'mysql':1A,20B,33B,36B,56B,59B,64C,66C,71C,81C,89C,115C,117C,129C,131C 'n/ac':148C 'n/s':151C 'n/ui':150C 'network':12A,43B,108C 'oracl':70C 'packag':21B 'product':68C 'program':6A,30B,74C 'protocol':112C 'result':51B,125C 'score':136C 'self':23B 'self-host':22B 'server':2A,34B,57B,65C,82C,116C,130C 'success':48B,119C 'support':75C 'takeov':10A,53B,127C 'u/c':152C 'unauthent':46B,105C 'vector':144C 'version':76C 'via':110C 'vulner':61C,103C,123C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Server or MySQL Cluster in the listed version ranges that accept network connections. Hosts where MySQL is bound to localhost or sits behind a firewall with no external access are less exposed. The sources do not state the exact fixed versions or the specific client program involved.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101771","severity":null,"published_at":"2026-10-20T22:18:32+00:00","modified_at":"2026-10-22T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}