---
id: "CVE-2026-101786"
kind: "vulnerability"
aliases: ["CVE-2026-101786"]
title: "MySQL Server optimizer flaw lets a privileged user take over the server"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mysql", "package", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-20T22:18:34+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:29:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101786", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# MySQL Server optimizer flaw lets a privileged user take over the server

MySQL Server and MySQL Cluster versions 26.7.0 through 26.7.1 contain a flaw in the Optimizer component. An attacker with high privileges and network access can take over the server, reading, changing and disrupting its data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `mysqld --version` or `SELECT VERSION();` and compare against 26.7.0 and 26.7.1
- Check whether MySQL Cluster (NDB) is in use with `SHOW ENGINES;`

## Fix

- Upgrade MySQL Server to a release after `26.7.1` once Oracle publishes a fixed version (unknown in sources)
- Upgrade MySQL Cluster to a release after `26.7.1` (unknown in sources)

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101786

## From the sources

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_