CVE-2026-101633
MediumCVSS 4.3Summary
Vulnerability in MySQL Router (component Router: General) version 26.7.0. It allows a low-privileged attacker with network access via HTTPS to gain unauthorized read access to a subset of MySQL Router accessible data.
Risk Assessment
Could lead to leakage of sensitive information from MySQL Router, posing a risk to data security. It requires only low privileges, increasing the potential threat.
Recommendation
Update MySQL Router to a version containing the fix. Restrict network access to the router and monitor for unusual HTTPS requests.
Other vulnerabilities in MySQL Router
See all- CVE-2026-101810High
Vulnerability in MySQL Router (component: Router: General) of Oracle MySQL, affecting version 26.7.0. An easily exploitable flaw allows an unauthenticated attacker with network access via multiple protocols to hang or repeatedly crash MySQL Router.
- CVE-2026-101783High
Vulnerability in MySQL Router (component: Router: General) affecting version 26.7.0. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTPS to create, delete or modify critical data and gain full access to all router-accessible data.
- CVE-2026-101632Medium
Vulnerability in MySQL Router (component Router: General) version 26.7.0. It allows an unauthenticated attacker with network access via HTTPS to gain unauthorized read access to a subset of data, but requires human interaction.
- CVE-2026-101631Medium
Vulnerability in MySQL Router (component Router: General) version 26.7.0. A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via HTTPS to gain unauthorized creation, deletion, or modification access to critical data and full access to data, but requires human interaction.
- CVE-2026-60725High
Vulnerability in MySQL Router. Difficult to exploit, unauthenticated attacker via HTTP can compromise data confidentiality and integrity.
- CVE-2026-60314High
Vulnerability in MySQL Router (component: Router: General) versions 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable, no authentication required, attacker with network access via HTTP can cause hang or frequent crashes (DOS) of MySQL Router.
Original NVD description (English source)
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS