{"id":"CVE-2026-101772","kind":"vulnerability","aliases":["CVE-2026-101772"],"related":[],"title":"MySQL Server and Cluster: client programs flaw allows server takeover","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"A flaw in the MySQL client programs component of MySQL Server and MySQL Cluster can be exploited over the network by an unauthenticated attacker. Successful exploitation can result in full takeover of the MySQL Server or Cluster, per the NVD description (CVSS 8.1).","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","package","self-hosted"],"not_affected_if":["version-outside-affected-range"],"how_to_check":"- Run `mysql --version` on hosts with MySQL Server or Cluster installed and compare against the affected ranges: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1, and 8.0.0-8.0.49 for MySQL Cluster.\n- Check which MySQL Server or Cluster versions are running in production, not only the client tools installed on the machine.","fix":"- Upgrade MySQL Server and MySQL Cluster to a release outside the affected ranges (fixed versions unknown from the sources; check the Oracle Critical Patch Update advisory).","status":"open","published_at":"2026-10-20T22:18:32+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:06:18+00:00","updated_at":"2026-10-25T03:06:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:06:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySQL Server and MySQL Cluster to a release outside the affected ranges (fixed versions unknown from the sources; check the Oracle Critical Patch Update advisory).","reach":"network","title":"MySQL Server and Cluster: client programs flaw allows server takeover","impact":"high","summary":"A flaw in the MySQL client programs component of MySQL Server and MySQL Cluster can be exploited over the network by an unauthenticated attacker. Successful exploitation can result in full takeover of the MySQL Server or Cluster, per the NVD description (CVSS 8.1).","category":"package","nicknames":[],"who_cares":["mysql","self-hosted","database"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over MySQL Server or Cluster over the network","analyst_note":"Check the Oracle Critical Patch Update advisory for fixed versions and any configuration preconditions, since the NVD text does not give them.","how_to_check":"- Run `mysql --version` on hosts with MySQL Server or Cluster installed and compare against the affected ranges: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1, and 8.0.0-8.0.49 for MySQL Cluster.\n- Check which MySQL Server or Cluster versions are running in production, not only the client tools installed on the machine.","needs_analyst":true,"not_affected_if":["version-outside-affected-range"],"who_is_affected":"Teams running MySQL Server or MySQL Cluster in the affected version ranges, reachable over the network. The sources do not say which configurations or client protocols are required beyond network access. Teams on other database products or versions outside the listed ranges can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":3564,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101772':13A,16A '-2026':12A,15A '/av':152C '26.7.0':92C,103C '26.7.1':93C,104C '3.1':139C,151C '8.0.0':96C '8.0.49':97C '8.1':65B,142C '8.4.0':88C,98C '8.4.12':89C,99C '9.7.0':90C,100C '9.7.3':91C,101C 'access':114C 'affect':84C 'allow':8A,109C 'attack':46B,111C,125C 'avail':146C 'base':140C 'client':5A,28B,78C 'cluster':4A,36B,59B,72C,95C,123C,137C 'compon':30B,77C 'compromis':119C 'confidenti':143C 'cve':11A,14A 'cvss':64B,138C,148C,150C 'databas':17B 'descript':63B 'difficult':105C 'exploit':39B,48B,107C 'flaw':7A,24B 'full':52B 'h':160C 'h/a':159C 'h/i':158C 'h/pr':154C 'host':22B 'impact':147C 'integr':144C 'multipl':116C 'mysql':1A,18B,27B,32B,35B,56B,69C,71C,76C,86C,94C,120C,122C,134C,136C 'n/ac':153C 'n/s':156C 'n/ui':155C 'network':42B,113C 'nvd':62B 'oracl':75C 'packag':19B 'per':60B 'product':73C 'program':6A,29B,79C 'protocol':117C 'result':50B,130C 'score':141C 'self':21B 'self-host':20B 'server':2A,9A,33B,57B,70C,87C,121C,135C 'success':47B,124C 'support':80C 'takeov':10A,53B,132C 'u/c':157C 'unauthent':45B,110C 'vector':149C 'version':81C 'via':115C 'vulner':66C,108C,128C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Server or MySQL Cluster in the affected version ranges, reachable over the network. The sources do not say which configurations or client protocols are required beyond network access. Teams on other database products or versions outside the listed ranges can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101772","severity":null,"published_at":"2026-10-20T22:18:32+00:00","modified_at":"2026-10-22T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}