Live › vulnerability › CVE-2026-101795
Go to dashboardA flaw in the Components Services part of MySQL Server and MySQL Cluster lets a high-privileged user who can log on to the host take over the server. The sources rate it CVSS 6.7 with full confidentiality, integrity and availability impact, and the affected versions are listed in the description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running MySQL Server or MySQL Cluster in the affected version ranges. The attacker must already hold high privileges and a logon on the host where MySQL runs, so exposure is mainly a concern on shared or poorly locked-down database hosts. Servers outside the listed versions are not affected.
No product ranges from the sources yet.
SELECT VERSION(); in the MySQL client and compare against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-101795")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.