{"id":"CVE-2026-83404","kind":"vulnerability","aliases":["CVE-2026-83404"],"related":[],"title":"MySQL Connector/Python: unauthenticated network attacker gains access to data","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle's MySQL Connector/Python 26.7.0 has a flaw that lets an unauthenticated attacker reach the connector over the network. Successful exploitation gives read access to data the connector can reach, per the CVSS vector (confidentiality high, no integrity or availability impact).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mysql","package","python"],"not_affected_if":["other-connector-versions"],"how_to_check":"- Run `pip show mysql-connector-python` (or `pip show mysql-connector-python-rf`) and compare the version with the affected `26.7.0`\n- Check the lockfile or `requirements.txt` for the connector version in use","fix":"- Upgrade Connector/Python past `26.7.0` to the patched release named in Oracle's advisory (unknown from the sources)","status":"open","published_at":"2026-10-20T22:19:56+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:18:52+00:00","updated_at":"2026-10-25T03:18:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:18:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Connector/Python past `26.7.0` to the patched release named in Oracle's advisory (unknown from the sources)","reach":"network","title":"MySQL Connector/Python: unauthenticated network attacker gains access to data","impact":"high","summary":"Oracle's MySQL Connector/Python 26.7.0 has a flaw that lets an unauthenticated attacker reach the connector over the network. Successful exploitation gives read access to data the connector can reach, per the CVSS vector (confidentiality high, no integrity or availability impact).","category":"package","nicknames":[],"who_cares":["python","mysql","database"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthorized read of data reachable through the connector","analyst_note":"Check Oracle's MySQL Connector/Python advisory for the patched version and the exact attack path; the NVD entry gives only the CVSS vector.","how_to_check":"- Run `pip show mysql-connector-python` (or `pip show mysql-connector-python-rf`) and compare the version with the affected `26.7.0`\n- Check the lockfile or `requirements.txt` for the connector version in use","needs_analyst":true,"not_affected_if":["other-connector-versions"],"who_is_affected":"Applications that load MySQL Connector/Python 26.7.0 and accept network traffic that reaches the connector. The sources do not describe the exact data path or configuration needed, so the exposed surface is unknown. Teams on other connector versions or other MySQL clients can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000628,"input_tokens":3445,"output_tokens":568,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-83404':12A,15A '/av':129C '26.7.0':24B,79C '3.1':119C,128C '7.5':122C 'access':7A,43B,88C,105C,111C,116C 'affect':77C 'allow':83C 'attack':5A,32B,85C,97C 'avail':59B 'base':120C 'complet':110C 'compon':70C 'compromis':93C 'confidenti':54B,123C 'connector':35B,47B,65C,95C,115C 'connector/python':2A,23B,71C 'critic':107C 'cve':10A,13A 'cvss':52B,118C,125C,127C 'data':9A,45B,108C,117C 'databas':16B 'easili':80C 'exploit':40B,81C 'flaw':27B 'gain':6A 'give':41B 'h/i':135C 'high':55B 'impact':60B,124C 'integr':57B 'l/pr':131C 'let':29B 'multipl':90C 'mysql':1A,17B,22B,64C,69C,94C,114C 'n':137C 'n/a':136C 'n/ac':130C 'n/s':133C 'n/ui':132C 'network':4A,38B,87C 'oracl':20B,68C 'packag':18B 'per':50B 'product':66C 'protocol':91C 'python':19B 'reach':33B,49B 'read':42B 'result':102C 'score':121C 'success':39B,96C 'support':73C 'u/c':134C 'unauthent':3A,31B,84C 'unauthor':104C 'vector':53B,126C 'version':74C 'via':89C 'vulner':61C,82C,100C","nicknames":[],"mitigations":[],"who_affected":"Applications that load MySQL Connector/Python 26.7.0 and accept network traffic that reaches the connector. The sources do not describe the exact data path or configuration needed, so the exposed surface is unknown. Teams on other connector versions or other MySQL clients can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83404","severity":null,"published_at":"2026-10-20T22:19:56+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}