{"id":"CVE-2026-101781","kind":"vulnerability","aliases":["CVE-2026-101781"],"related":[],"title":"MySQL Group Replication: adjacent-network flaw lets attacker take over server","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"MySQL Server and MySQL Cluster have a flaw in the Group Replication GCS component. An unauthenticated attacker on the same network segment as the database host can take over the server, with full confidentiality, integrity and availability impact.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["group-replication","mysql","mysql-cluster","runtime","self-hosted"],"not_affected_if":["group-replication-disabled","versions-outside-listed-ranges"],"how_to_check":"Run SELECT VERSION(); and check whether Group Replication is in use (SELECT * FROM performance_schema.replication_group_members;).\nAffected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.","fix":"Until patched, restrict network access to the Group Replication port to trusted cluster members.","status":"open","published_at":"2026-10-20T22:18:33+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:38:41+00:00","updated_at":"2026-10-23T22:38:41+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:38:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown: the sources list affected ranges but not the patched release; take the fixed version from Oracle's advisory.\nUntil patched, restrict network access to the Group Replication port to trusted cluster members.","reach":"network","title":"MySQL Group Replication: adjacent-network flaw lets attacker take over server","impact":"high","summary":"MySQL Server and MySQL Cluster have a flaw in the Group Replication GCS component. An unauthenticated attacker on the same network segment as the database host can take over the server, with full confidentiality, integrity and availability impact.","category":"runtime","who_cares":["mysql","mysql-cluster","group-replication","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker takes over the MySQL server on the same network segment","analyst_note":"Find the patched MySQL versions in Oracle's Critical Patch Update advisory (sources give only NVD); the description says physical segment but the CVSS vector is AV:A (adjacent), so confirm the reach.","how_to_check":"Run SELECT VERSION(); and check whether Group Replication is in use (SELECT * FROM performance_schema.replication_group_members;).\nAffected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.","needs_analyst":true,"not_affected_if":["group-replication-disabled","versions-outside-listed-ranges"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000894,"input_tokens":3222,"output_tokens":1143,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101781':15A,18A '-2026':14A,17A '/av':167C '26.7.0':96C,107C '26.7.1':97C,108C '3.1':154C,166C '8.0.0':100C '8.0.49':101C '8.4.0':92C,102C '8.4.12':93C,103C '8.8':157C '9.7.0':94C,104C '9.7.3':95C,105C 'a/ac':168C 'access':116C 'adjac':5A 'adjacent-network':4A 'affect':88C 'allow':112C 'attach':122C 'attack':9A,46B,114C,140C 'avail':66B,161C 'base':155C 'cluster':25B,34B,74C,99C,131C,138C,152C 'communic':120C 'compon':43B,79C 'compromis':134C 'confidenti':63B,158C 'cve':13A,16A 'cvss':153C,163C,165C 'databas':54B 'easili':109C 'execut':132C 'exploit':110C 'flaw':7A,37B 'full':62B 'gcs':42B,83C 'group':2A,20B,40B,81C 'group-repl':19B 'h':175C 'h/a':174C 'h/i':173C 'hardwar':125C 'host':29B,55B 'impact':67B,162C 'integr':64B,159C 'l/pr':169C 'let':8A 'mysql':1A,22B,24B,30B,33B,71C,73C,78C,90C,98C,128C,130C,135C,137C,149C,151C 'mysql-clust':23B 'n/s':171C 'n/ui':170C 'network':6A,50B 'oracl':77C 'physic':119C 'product':75C 'replic':3A,21B,41B,82C 'result':145C 'runtim':26B 'score':156C 'segment':51B,121C 'self':28B 'self-host':27B 'server':12A,31B,60B,72C,80C,91C,129C,136C,150C 'success':139C 'support':84C 'take':10A,57B 'takeov':147C 'u/c':172C 'unauthent':45B,113C 'vector':164C 'version':85C 'vulner':68C,111C,143C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101781","severity":null,"published_at":"2026-10-20T22:18:33+00:00","modified_at":"2026-10-22T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}