{"id":"CVE-2026-101795","kind":"vulnerability","aliases":["CVE-2026-101795"],"related":[],"title":"MySQL Server: Components Services flaw lets a privileged local user take over","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"A flaw in the Components Services part of MySQL Server and MySQL Cluster lets a high-privileged user who can log on to the host take over the server. The sources rate it CVSS 6.7 with full confidentiality, integrity and availability impact, and the affected versions are listed in the description.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","package","self-hosted"],"not_affected_if":["managed-hosting","version-outside-range"],"how_to_check":"- Run `SELECT VERSION();` in the MySQL client and compare against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.","fix":null,"status":"open","published_at":"2026-10-20T22:18:35+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:46:38+00:00","updated_at":"2026-10-25T03:46:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:46:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"MySQL Server: Components Services flaw lets a privileged local user take over","impact":"high","summary":"A flaw in the Components Services part of MySQL Server and MySQL Cluster lets a high-privileged user who can log on to the host take over the server. The sources rate it CVSS 6.7 with full confidentiality, integrity and availability impact, and the affected versions are listed in the description.","category":"package","nicknames":[],"who_cares":["mysql","self-hosted","database"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with host logon and high privileges takes over the MySQL server","analyst_note":"Check Oracle's April 2026 Critical Patch Update advisory for the fixed version numbers and the exact Components Services details, since the sources give no fix.","how_to_check":"- Run `SELECT VERSION();` in the MySQL client and compare against the affected ranges: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.","needs_analyst":true,"not_affected_if":["version-outside-range","managed-hosting"],"who_is_affected":"Teams running MySQL Server or MySQL Cluster in the affected version ranges. The attacker must already hold high privileges and a logon on the host where MySQL runs, so exposure is mainly a concern on shared or poorly locked-down database hosts. Servers outside the listed versions are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":3586,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101795':14A,17A '-2026':13A,16A '/av':168C '26.7.0':103C,114C '26.7.1':104C,115C '3.1':155C,167C '6.7':59B,158C '8.0.0':107C '8.0.49':108C '8.4.0':99C,109C '8.4.12':100C,110C '9.7.0':101C,111C '9.7.3':102C,112C 'affect':69B,95C 'allow':119C 'attack':122C,141C 'avail':65B,162C 'base':156C 'cluster':36B,82C,106C,132C,139C,153C 'compon':3A,28B,87C,89C 'compromis':135C 'confidenti':62B,159C 'cve':12A,15A 'cvss':58B,154C,164C,166C 'databas':18B 'descript':75B 'easili':116C 'execut':133C 'exploit':117C 'flaw':5A,25B 'full':61B 'h':176C 'h/a':175C 'h/i':174C 'h/ui':171C 'high':40B,120C 'high-privileg':39B 'host':23B,49B 'impact':66B,163C 'infrastructur':127C 'integr':63B,160C 'l/ac':169C 'l/pr':170C 'let':6A,37B 'list':72B 'local':9A 'log':45B 'logon':124C 'mysql':1A,19B,32B,35B,79C,81C,86C,97C,105C,129C,131C,136C,138C,150C,152C 'n/s':172C 'oracl':85C 'packag':20B 'part':30B 'privileg':8A,41B,121C 'product':83C 'rate':56B 'result':146C 'score':157C 'self':22B 'self-host':21B 'server':2A,33B,53B,80C,88C,98C,130C,137C,151C 'servic':4A,29B,90C 'sourc':55B 'success':140C 'support':91C 'take':11A,50B 'takeov':148C 'u/c':173C 'user':10A,42B 'vector':165C 'version':70B,92C 'vulner':76C,118C,144C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Server or MySQL Cluster in the affected version ranges. The attacker must already hold high privileges and a logon on the host where MySQL runs, so exposure is mainly a concern on shared or poorly locked-down database hosts. Servers outside the listed versions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101795","severity":null,"published_at":"2026-10-20T22:18:35+00:00","modified_at":"2026-10-22T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}