Live › vulnerability › CVE-2026-101773
Go to dashboardThe Group Replication plugin in MySQL Server and MySQL Cluster has a flaw that lets an unauthenticated attacker on the same network segment repeatedly crash the server. The same flaw allows some unauthorized update, insert or delete of accessible data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only servers running the affected versions with the Group Replication plugin in use are in scope. The attack requires an attacker on the physical or adjacent network segment of the host, so internet-only exposure is not the main path. Hosts isolated on a private segment with no untrusted machines on it carry lower practical risk.
No product ranges from the sources yet.
SELECT @@version; on each MySQL Server and MySQL Cluster node and compare against the affected rangesSELECT PLUGIN_NAME, PLUGIN_STATUS FROM information_schema.PLUGINS WHERE PLUGIN_NAME LIKE 'group_replication'; to see whether Group Replication is active8.4.12, 9.7.x to a release after 9.7.3, and 26.7.x to a release after 26.7.18.0.49 and 8.4.x to a release after 8.4.12, 9.7.x to a release after 9.7.3, and 26.7.x to a release after 26.7.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-101773")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.