{"id":"CVE-2026-101779","kind":"vulnerability","aliases":["CVE-2026-101779"],"related":[],"title":"MySQL Server Telemetry flaw lets high-privileged users cause partial denial of service","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","summary":"A flaw in the Telemetry component of MySQL Server and MySQL Cluster lets a highly privileged network user cause a partial denial of service. Oracle rates it low, with a CVSS 3.1 score of 2.7 for availability impact only.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["databases","mysql","package","self-hosted"],"not_affected_if":["managed-hosting","version-outside-range"],"how_to_check":"- Run `SELECT VERSION();` in MySQL to see whether the server is in an affected range: 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, or 26.7.0 to 26.7.1.\n- Check whether the MySQL Cluster build is in the same affected ranges.","fix":"- Move MySQL Server to a release outside the affected ranges (fixed version unknown from sources).\n- Move MySQL Cluster to a release outside the affected ranges (fixed version unknown from sources).","status":"open","published_at":"2026-10-20T22:18:33+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T04:48:04+00:00","updated_at":"2026-10-25T04:48:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:48:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move MySQL Server to a release outside the affected ranges (fixed version unknown from sources).\n- Move MySQL Cluster to a release outside the affected ranges (fixed version unknown from sources).","reach":"network","title":"MySQL Server Telemetry flaw lets high-privileged users cause partial denial of service","impact":"low","summary":"A flaw in the Telemetry component of MySQL Server and MySQL Cluster lets a highly privileged network user cause a partial denial of service. Oracle rates it low, with a CVSS 3.1 score of 2.7 for availability impact only.","category":"package","nicknames":[],"who_cares":["mysql","databases","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Partial denial of service on the database server","analyst_note":"","how_to_check":"- Run `SELECT VERSION();` in MySQL to see whether the server is in an affected range: 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, or 26.7.0 to 26.7.1.\n- Check whether the MySQL Cluster build is in the same affected ranges.","needs_analyst":false,"not_affected_if":["version-outside-range","managed-hosting"],"who_is_affected":"Teams running MySQL Server or MySQL Cluster in the listed version ranges are exposed. The attacker needs high privileges and network access, so exposure is mainly a risk on databases reachable from many clients or from less trusted networks. Teams on other versions or other database products can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000642,"input_tokens":3565,"output_tokens":571,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101779':17A,20A '-2026':16A,19A '/av':156C '2.7':61B,149C '26.7.0':91C,100C '26.7.1':92C,101C '3.1':58B,146C,155C '8.4.0':87C,95C '8.4.12':88C,96C '9.7.0':89C,97C '9.7.3':90C,98C 'abil':130C 'access':111C 'affect':83C 'allow':105C 'attack':108C,122C 'avail':63B,150C 'base':147C 'caus':10A,45B,132C 'cluster':38B,71C,94C,120C,144C 'compon':32B,76C 'compromis':116C 'cve':15A,18A 'cvss':57B,145C,152C,154C 'databas':21B 'denial':12A,48B,135C 'dos':139C 'easili':102C 'exploit':103C 'flaw':4A,28B 'h/ui':159C 'high':7A,41B,106C 'high-privileg':6A 'host':26B 'impact':64B,151C 'l':164C 'l/pr':158C 'let':5A,39B 'low':54B 'multipl':113C 'mysql':1A,22B,34B,37B,68C,70C,75C,85C,93C,117C,119C,141C,143C 'n/a':163C 'n/ac':157C 'n/i':162C 'n/s':160C 'network':43B,110C 'oracl':51B,74C 'packag':23B 'partial':11A,47B,134C,138C 'privileg':8A,42B,107C 'product':72C 'protocol':114C 'rate':52B 'result':127C 'score':59B,148C 'self':25B 'self-host':24B 'server':2A,35B,69C,77C,86C,118C,142C 'servic':14A,50B,137C 'success':121C 'support':79C 'telemetri':3A,31B,78C 'u/c':161C 'unauthor':129C 'user':9A,44B 'vector':153C 'version':80C 'via':112C 'vulner':65C,104C,125C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Server or MySQL Cluster in the listed version ranges are exposed. The attacker needs high privileges and network access, so exposure is mainly a risk on databases reachable from many clients or from less trusted networks. Teams on other versions or other database products can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101779","severity":null,"published_at":"2026-10-20T22:18:33+00:00","modified_at":"2026-10-22T18:17:22+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}