{"id":"CVE-2026-101773","kind":"vulnerability","aliases":["CVE-2026-101773"],"related":[],"title":"MySQL Group Replication: adjacent-network attacker can crash server and alter data","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).","summary":"The Group Replication plugin in MySQL Server and MySQL Cluster has a flaw that lets an unauthenticated attacker on the same network segment repeatedly crash the server. The same flaw allows some unauthorized update, insert or delete of accessible data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","group-replication","mysql","mysql-cluster","package","self-hosted"],"not_affected_if":["default-config","internet-isolated-segment","no-group-replication"],"how_to_check":"- Run `SELECT @@version;` on each MySQL Server and MySQL Cluster node and compare against the affected ranges\n- Run `SELECT PLUGIN_NAME, PLUGIN_STATUS FROM information_schema.PLUGINS WHERE PLUGIN_NAME LIKE 'group_replication';` to see whether Group Replication is active","fix":"- Move MySQL Server 8.4.x to a release after `8.4.12`, 9.7.x to a release after `9.7.3`, and 26.7.x to a release after `26.7.1`\n- Move MySQL Cluster 8.0.x to a release after `8.0.49` and 8.4.x to a release after `8.4.12`, 9.7.x to a release after `9.7.3`, and 26.7.x to a release after `26.7.1`\n- Apply Oracle's January-style patch level for the branch you run; the sources do not name the exact fixed build","status":"open","published_at":"2026-10-20T22:18:32+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:34:24+00:00","updated_at":"2026-10-25T03:34:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:34:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move MySQL Server 8.4.x to a release after `8.4.12`, 9.7.x to a release after `9.7.3`, and 26.7.x to a release after `26.7.1`\n- Move MySQL Cluster 8.0.x to a release after `8.0.49` and 8.4.x to a release after `8.4.12`, 9.7.x to a release after `9.7.3`, and 26.7.x to a release after `26.7.1`\n- Apply Oracle's January-style patch level for the branch you run; the sources do not name the exact fixed build","reach":"network","title":"MySQL Group Replication: adjacent-network attacker can crash server and alter data","impact":"high","summary":"The Group Replication plugin in MySQL Server and MySQL Cluster has a flaw that lets an unauthenticated attacker on the same network segment repeatedly crash the server. The same flaw allows some unauthorized update, insert or delete of accessible data.","category":"package","nicknames":[],"who_cares":["mysql","mysql-cluster","group-replication","self-hosted","database"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker crashes the database repeatedly and alters some stored data","analyst_note":"Check the Oracle Critical Patch Update advisory for the exact fixed build numbers per branch; the sources give only version ranges.","how_to_check":"- Run `SELECT @@version;` on each MySQL Server and MySQL Cluster node and compare against the affected ranges\n- Run `SELECT PLUGIN_NAME, PLUGIN_STATUS FROM information_schema.PLUGINS WHERE PLUGIN_NAME LIKE 'group_replication';` to see whether Group Replication is active","needs_analyst":true,"not_affected_if":["default-config","no-group-replication","internet-isolated-segment"],"who_is_affected":"Only servers running the affected versions with the Group Replication plugin in use are in scope. The attack requires an attacker on the physical or adjacent network segment of the host, so internet-only exposure is not the main path. Hosts isolated on a private segment with no untrusted machines on it carry lower practical risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":3664,"output_tokens":782,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101773':16A,19A '-2026':15A,18A '/av':199C '26.7.0':100C,111C '26.7.1':101C,112C '3.1':187C,198C '7.1':190C '8.0.0':104C '8.0.49':105C '8.4.0':96C,106C '8.4.12':97C,107C '9.7.0':98C,108C '9.7.3':99C,109C 'a/ac':200C 'abil':152C 'access':70B,120C,176C,184C 'adjac':5A 'adjacent-network':4A 'affect':92C 'allow':62B,116C 'alter':12A 'attach':126C 'attack':7A,49B,118C,144C 'avail':193C 'base':188C 'caus':154C 'cluster':27B,41B,78C,103C,135C,142C,167C,183C 'communic':124C 'complet':161C 'compon':83C 'compromis':138C 'crash':9A,56B,160C 'cve':14A,17A 'cvss':186C,195C,197C 'data':13A,71B,185C 'databas':20B 'delet':68B,175C 'dos':162C 'easili':113C 'execut':136C 'exploit':114C 'flaw':44B,61B 'frequent':158C 'group':2A,22B,33B,85C 'group-repl':21B 'h':207C 'hang':156C 'hardwar':129C 'host':31B 'impact':194C 'insert':66B,173C 'integr':191C 'l/a':206C 'l/pr':201C 'let':46B 'mysql':1A,24B,26B,37B,40B,75C,77C,82C,94C,102C,132C,134C,139C,141C,164C,166C,180C,182C 'mysql-clust':25B 'n/i':205C 'n/s':203C 'n/ui':202C 'network':6A,53B 'oracl':81C 'packag':28B 'physic':123C 'plugin':35B,87C 'product':79C 'repeat':55B,159C 'replic':3A,23B,34B,86C 'result':149C 'score':189C 'segment':54B,125C 'self':30B 'self-host':29B 'server':10A,38B,58B,76C,84C,95C,133C,140C,165C,181C 'success':143C 'support':88C 'u/c':204C 'unauthent':48B,117C 'unauthor':64B,151C,171C 'updat':65B,172C 'vector':196C 'version':89C 'vulner':72C,115C,147C 'well':169C","nicknames":[],"mitigations":[],"who_affected":"Only servers running the affected versions with the Group Replication plugin in use are in scope. The attack requires an attacker on the physical or adjacent network segment of the host, so internet-only exposure is not the main path. Hosts isolated on a private segment with no untrusted machines on it carry lower practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101773","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101773","severity":null,"published_at":"2026-10-20T22:18:32+00:00","modified_at":"2026-10-22T18:17:21+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}