CVE-2026-101632
MediumCVSS 4.3Summary
Vulnerability in MySQL Router (component Router: General) version 26.7.0. It allows an unauthenticated attacker with network access via HTTPS to gain unauthorized read access to a subset of data, but requires human interaction.
Risk Assessment
Could lead to leakage of sensitive information from MySQL Router. It requires user interaction, which somewhat limits attack vectors but still poses a risk.
Recommendation
Update MySQL Router to a version containing the fix. Additionally, educate users on safe behaviors and restrict network access.
Other vulnerabilities in MySQL Router
See all- CVE-2026-101810High
Vulnerability in MySQL Router (component: Router: General) of Oracle MySQL, affecting version 26.7.0. An easily exploitable flaw allows an unauthenticated attacker with network access via multiple protocols to hang or repeatedly crash MySQL Router.
- CVE-2026-101783High
Vulnerability in MySQL Router (component: Router: General) affecting version 26.7.0. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTPS to create, delete or modify critical data and gain full access to all router-accessible data.
- CVE-2026-101633Medium
Vulnerability in MySQL Router (component Router: General) version 26.7.0. It allows a low-privileged attacker with network access via HTTPS to gain unauthorized read access to a subset of MySQL Router accessible data.
- CVE-2026-101631Medium
Vulnerability in MySQL Router (component Router: General) version 26.7.0. A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via HTTPS to gain unauthorized creation, deletion, or modification access to critical data and full access to data, but requires human interaction.
- CVE-2026-60725High
Vulnerability in MySQL Router. Difficult to exploit, unauthenticated attacker via HTTP can compromise data confidentiality and integrity.
- CVE-2026-60314High
Vulnerability in MySQL Router (component: Router: General) versions 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable, no authentication required, attacker with network access via HTTP can cause hang or frequent crashes (DOS) of MySQL Router.
Original NVD description (English source)
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS