{"id":"CVE-2026-101786","kind":"vulnerability","aliases":["CVE-2026-101786"],"related":[],"title":"MySQL Server optimizer flaw lets a privileged user take over the server","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"MySQL Server and MySQL Cluster versions 26.7.0 through 26.7.1 contain a flaw in the Optimizer component. An attacker with high privileges and network access can take over the server, reading, changing and disrupting its data.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","package","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"- Run `mysqld --version` or `SELECT VERSION();` and compare against 26.7.0 and 26.7.1\n- Check whether MySQL Cluster (NDB) is in use with `SHOW ENGINES;`","fix":"- Upgrade MySQL Server to a release after `26.7.1` once Oracle publishes a fixed version (unknown in sources)\n- Upgrade MySQL Cluster to a release after `26.7.1` (unknown in sources)","status":"open","published_at":"2026-10-20T22:18:34+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:29:12+00:00","updated_at":"2026-10-25T03:29:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:29:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySQL Server to a release after `26.7.1` once Oracle publishes a fixed version (unknown in sources)\n- Upgrade MySQL Cluster to a release after `26.7.1` (unknown in sources)","reach":"network","title":"MySQL Server optimizer flaw lets a privileged user take over the server","impact":"high","summary":"MySQL Server and MySQL Cluster versions 26.7.0 through 26.7.1 contain a flaw in the Optimizer component. An attacker with high privileges and network access can take over the server, reading, changing and disrupting its data.","category":"package","nicknames":[],"who_cares":["mysql","database","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges takes over the MySQL server","analyst_note":"Check the Oracle MySQL security alert and the NVD entry for fixed version numbers and the specific query or protocol trigger.","how_to_check":"- Run `mysqld --version` or `SELECT VERSION();` and compare against 26.7.0 and 26.7.1\n- Check whether MySQL Cluster (NDB) is in use with `SHOW ENGINES;`","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams running MySQL Server or MySQL Cluster at versions 26.7.0 or 26.7.1 that accept network connections from users with elevated database privileges. The sources do not say which configurations are exposed beyond the privilege requirement, so exposure is unknown; installations on other versions are not listed as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":3503,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101786':15A,18A '-2026':14A,17A '/av':135C '26.7.0':31B,82C,86C '26.7.1':33B,83C,87C '3.1':122C,134C '7.2':125C 'access':48B,97C 'affect':78C 'allow':91C 'attack':42B,94C,108C 'avail':129C 'base':123C 'chang':55B 'cluster':29B,66C,85C,106C,120C 'compon':40B,71C 'compromis':102C 'confidenti':126C 'contain':34B 'cve':13A,16A 'cvss':121C,131C,133C 'data':59B 'databas':19B 'disrupt':57B 'easili':88C 'exploit':89C 'flaw':4A,36B 'h':143C 'h/a':142C 'h/i':141C 'h/ui':138C 'high':44B,92C 'host':24B 'impact':130C 'integr':127C 'l/pr':137C 'let':5A 'multipl':99C 'mysql':1A,20B,25B,28B,63C,65C,70C,80C,84C,103C,105C,117C,119C 'n/ac':136C 'n/s':139C 'network':47B,96C 'optim':3A,39B,73C 'oracl':69C 'packag':21B 'privileg':7A,45B,93C 'product':67C 'protocol':100C 'read':54B 'result':113C 'score':124C 'self':23B 'self-host':22B 'server':2A,12A,26B,53B,64C,72C,81C,104C,118C 'success':107C 'support':74C 'take':9A,50B 'takeov':115C 'u/c':140C 'user':8A 'vector':132C 'version':30B,75C 'via':98C 'vulner':60C,90C,111C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Server or MySQL Cluster at versions 26.7.0 or 26.7.1 that accept network connections from users with elevated database privileges. The sources do not say which configurations are exposed beyond the privilege requirement, so exposure is unknown; installations on other versions are not listed as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101786","severity":null,"published_at":"2026-10-20T22:18:34+00:00","modified_at":"2026-10-22T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}