---
id: "CVE-2026-101771"
kind: "vulnerability"
aliases: ["CVE-2026-101771"]
title: "MySQL Server and Cluster: client programs flaw allows full takeover over network"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mysql", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "network-isolated"]
published_at: "2026-10-20T22:18:32+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:06:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101771", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# MySQL Server and Cluster: client programs flaw allows full takeover over network

A flaw in the client programs component of MySQL Server and MySQL Cluster can be exploited over the network by an unauthenticated attacker. Successful attacks can result in takeover of the MySQL Server or MySQL Cluster.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `mysqld --version` on each database host and compare against the affected ranges: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1, and 8.0.0-8.0.49 for MySQL Cluster.
- Check whether the server listens on the network with `ss -ltnp | grep mysql`.

## Fix

- Upgrade MySQL Server and MySQL Cluster to a release outside the affected ranges; the exact fixed versions are unknown from the sources.
- Restrict network access to the MySQL port until patched.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101771

## From the sources

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_