---
id: "CVE-2026-83404"
kind: "vulnerability"
aliases: ["CVE-2026-83404"]
title: "MySQL Connector/Python: unauthenticated network attacker gains access to data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mysql", "package", "python"]
not_affected_if: ["other-connector-versions"]
published_at: "2026-10-20T22:19:56+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:18:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83404", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# MySQL Connector/Python: unauthenticated network attacker gains access to data

Oracle's MySQL Connector/Python 26.7.0 has a flaw that lets an unauthenticated attacker reach the connector over the network. Successful exploitation gives read access to data the connector can reach, per the CVSS vector (confidentiality high, no integrity or availability impact).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pip show mysql-connector-python` (or `pip show mysql-connector-python-rf`) and compare the version with the affected `26.7.0`
- Check the lockfile or `requirements.txt` for the connector version in use

## Fix

- Upgrade Connector/Python past `26.7.0` to the patched release named in Oracle's advisory (unknown from the sources)

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83404

## From the sources

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_