---
id: "CVE-2026-101773"
kind: "vulnerability"
aliases: ["CVE-2026-101773"]
title: "MySQL Group Replication: adjacent-network attacker can crash server and alter data"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "group-replication", "mysql", "mysql-cluster", "package", "self-hosted"]
not_affected_if: ["default-config", "internet-isolated-segment", "no-group-replication"]
published_at: "2026-10-20T22:18:32+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:34:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101773", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# MySQL Group Replication: adjacent-network attacker can crash server and alter data

The Group Replication plugin in MySQL Server and MySQL Cluster has a flaw that lets an unauthenticated attacker on the same network segment repeatedly crash the server. The same flaw allows some unauthorized update, insert or delete of accessible data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `SELECT @@version;` on each MySQL Server and MySQL Cluster node and compare against the affected ranges
- Run `SELECT PLUGIN_NAME, PLUGIN_STATUS FROM information_schema.PLUGINS WHERE PLUGIN_NAME LIKE 'group_replication';` to see whether Group Replication is active

## Fix

- Move MySQL Server 8.4.x to a release after `8.4.12`, 9.7.x to a release after `9.7.3`, and 26.7.x to a release after `26.7.1`
- Move MySQL Cluster 8.0.x to a release after `8.0.49` and 8.4.x to a release after `8.4.12`, 9.7.x to a release after `9.7.3`, and 26.7.x to a release after `26.7.1`
- Apply Oracle's January-style patch level for the branch you run; the sources do not name the exact fixed build

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101773

## From the sources

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_