CVE-2026-101769
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Vulnerability in MySQL Cluster (component Cluster: General) affecting versions 26.7.0-26.7.1. A difficult-to-exploit network attack via TCP allows an unauthenticated attacker to cause a hang or repeatable crash (complete DoS) and unauthorized read and modification of some data.
Risk Assessment
May lead to database cluster unavailability and data leakage or modification, disrupting critical services.
Recommendation
Update MySQL Cluster to a version outside 26.7.0-26.7.1 per Oracle guidance; restrict network access to cluster ports.
Other vulnerabilities in MySQL Cluster
See all- CVE-2026-101628Medium
A vulnerability in Oracle MySQL Cluster (Cluster: NDB Operator component) affects version 9.7.3. A low-privileged attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) of MySQL Cluster.
- CVE-2026-101513Low
Vulnerability in MySQL Cluster (component InnoDB) affecting versions 8.0.0-8.0.37. A difficult-to-exploit attack requiring physical access can cause a hang or repeatable crash (complete DoS).
- CVE-2026-70724High
Vulnerability in MySQL Cluster (component: Cluster: General) affects versions 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. An unauthenticated attacker can take over MySQL Cluster over HTTP with user interaction.
- CVE-2026-60592High
Vulnerability in Oracle's MySQL Cluster product (component: Cluster: NDB Operator). Affected versions are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks can cause a hang or frequently repeatable crash (complete DoS) and unauthorized update, insert or delete access to some data.
- CVE-2026-60569Medium
Vulnerability in MySQL Cluster (Cluster: NDB Operator component) versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. An unauthenticated attacker with local access can exploit this vulnerability, potentially leading to unauthorized access to critical data or full access to all MySQL Cluster data.
- CVE-2026-60171Medium
Vulnerability in Oracle MySQL's MySQL Cluster product (component: Server: Optimizer). Affected versions are 8.0.0-8.0.47. Easily exploitable by a high-privileged attacker with network access via multiple protocols, potentially causing a hang or frequent crash (full DOS) of the MySQL Cluster.
Original NVD description (English source)
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as unauthorized update, insert or delete access to some of MySQL Cluster accessible data and unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS