{"id":"CVE-2026-101804","kind":"vulnerability","aliases":["CVE-2026-101804"],"related":[],"title":"MySQL Connector/ODBC: local partial denial of service, CVSS 2.5","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).   The supported version that is affected is 26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 2.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).","summary":"Oracle's MySQL Connector/ODBC has a flaw that lets a local user who can already log on to the host partly disrupt the connector. The sources describe only a partial denial of service with no data exposure or code execution.","severity":"low","cvss":2.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["connector-odbc","mysql","odbc","package"],"not_affected_if":["no-local-logons","other-connector-version"],"how_to_check":"- Run `odbcinst -j` or check the installed Connector/ODBC version and compare it to `26.7.1`\n- Confirm whether untrusted local users can log on to hosts running the connector","fix":"- Move Connector/ODBC to a release newer than `26.7.1` once Oracle publishes one (unknown from sources)","status":"open","published_at":"2026-10-20T22:18:36+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T04:49:33+00:00","updated_at":"2026-10-25T04:49:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:49:33Z","model":"claude-haiku-5-5","output":{"fix":"- Move Connector/ODBC to a release newer than `26.7.1` once Oracle publishes one (unknown from sources)","reach":"local","title":"MySQL Connector/ODBC: local partial denial of service, CVSS 2.5","impact":"low","summary":"Oracle's MySQL Connector/ODBC has a flaw that lets a local user who can already log on to the host partly disrupt the connector. The sources describe only a partial denial of service with no data exposure or code execution.","category":"package","nicknames":[],"who_cares":["mysql","odbc","connector-odbc"],"confidence":0.7,"needs_auth":"yes","worst_case":"Partial denial of service of the MySQL Connector on the host","analyst_note":"","how_to_check":"- Run `odbcinst -j` or check the installed Connector/ODBC version and compare it to `26.7.1`\n- Confirm whether untrusted local users can log on to hosts running the connector","needs_analyst":false,"not_affected_if":["no-local-logons","other-connector-version"],"who_is_affected":"Teams running MySQL Connector/ODBC version 26.7.1 on hosts where local users can log on and unknown others could reach the connector's workload. Systems without a local untrusted user or without this connector can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000588,"input_tokens":3483,"output_tokens":479,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101804':12A,15A '-2026':11A,14A '/av':146C '2.5':9A,139C '26.7.1':80C '3.1':136C,145C 'abil':122C 'affect':78C 'allow':85C 'alreadi':36B 'attack':87C,102C,112C,114C 'avail':140C 'base':137C 'caus':124C 'code':60B 'compon':71C 'compromis':98C 'connector':17B,45B,66C,95C,100C,134C 'connector-odbc':16B 'connector/odbc':2A,25B,72C 'cve':10A,13A 'cvss':8A,135C,142C,144C 'data':57B 'denial':5A,52B,127C 'describ':48B 'difficult':81C 'disrupt':43B 'dos':131C 'execut':61B,96C 'exploit':83C 'exposur':58B 'flaw':28B 'h/pr':148C 'host':41B 'human':104C 'impact':141C 'infrastructur':92C 'interact':105C 'l':154C 'l/ac':147C 'let':30B 'local':3A,32B 'log':37B 'logon':89C 'mysql':1A,19B,24B,65C,70C,94C,99C,133C 'n/a':153C 'n/i':152C 'n/ui':149C 'odbc':18B,20B 'oracl':22B,69C 'packag':21B 'part':42B 'partial':4A,51B,126C,130C 'person':108C 'product':67C 'r/s':150C 'requir':103C 'result':119C 'score':138C 'servic':7A,54B,129C 'sourc':47B 'success':101C,113C 'support':74C 'u/c':151C 'unauthent':86C 'unauthor':121C 'user':33B 'vector':143C 'version':75C 'vulner':62C,84C,117C","nicknames":[],"mitigations":[],"who_affected":"Teams running MySQL Connector/ODBC version 26.7.1 on hosts where local users can log on and unknown others could reach the connector's workload. Systems without a local untrusted user or without this connector can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101804","severity":null,"published_at":"2026-10-20T22:18:36+00:00","modified_at":"2026-10-22T18:17:25+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}