---
id: "CVE-2026-101781"
kind: "vulnerability"
aliases: ["CVE-2026-101781"]
title: "MySQL Group Replication: adjacent-network flaw lets attacker take over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["group-replication", "mysql", "mysql-cluster", "runtime", "self-hosted"]
not_affected_if: ["group-replication-disabled", "versions-outside-listed-ranges"]
published_at: "2026-10-20T22:18:33+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-23T22:38:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101781", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# MySQL Group Replication: adjacent-network flaw lets attacker take over server

MySQL Server and MySQL Cluster have a flaw in the Group Replication GCS component. An unauthenticated attacker on the same network segment as the database host can take over the server, with full confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run SELECT VERSION(); and check whether Group Replication is in use (SELECT * FROM performance_schema.replication_group_members;).
Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

## Fix

Until patched, restrict network access to the Group Replication port to trusted cluster members.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101781

## From the sources

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_