Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.37. Difficult to exploit vulnerability allows physical access to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 3.8 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 3.8 Low
EPSS: < 1% Very Low
KEV: No
Impact: Availability - Denial of Service
Action: Apply Patch
AI Analysis

Impact

A vulnerability exists in the InnoDB component of Oracle MySQL Cluster that requires a user to have physical access and high local privileges. An attacker who can reach the server can exploit the flaw in a way that causes the cluster to hang or crash repeatedly, resulting in a denial of service that affects the availability of the database service.

Affected Systems

Oracle MySQL Cluster versions 8.0.0 through 8.0.37 are affected. No other products or newer major releases are listed as vulnerable.

Risk and Exploitability

The CVSS base score of 3.8 confirms the vulnerability is accessed via physical presence, requires high local privileges, and does not need user interaction, affecting only availability. Because it requires direct physical access and high privileges, exploitation is unlikely to be achieved remotely, making it challenging to carry out without on-site access. The EPSS score is less than 1% (approximately 0.0017), and the flaw is not included in CISA's KEV catalog, indicating a very low probability of widespread exploitation in the current environment.

Generated by OpenCVE AI on November 5, 2026 at 19:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MySQL Cluster to a version that contains the fix for the InnoDB issue.
  • Restrict physical and local administrative access to the servers running MySQL Cluster so that only trusted personnel can log on or physically reach the machines.
  • Configure monitoring of MySQL Cluster logs and system metrics to detect hangs or crashes, and set up alerts to notify administrators of abnormal shutdowns.

Generated by OpenCVE AI on November 5, 2026 at 19:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Physical Access Enables Denial‑of‑Service via InnoDB in MySQL Cluster mysql: mysql: Denial of Service via physical access
Weaknesses CWE-617
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 21 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
Title Physical Access Enables Denial‑of‑Service via InnoDB in MySQL Cluster
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.37. Difficult to exploit vulnerability allows physical access to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 3.8 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
References
Metrics cvssV3_1

{'score': 3.8, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-05T16:07:15.514Z

Reserved: 2026-09-28T15:40:09.488Z

Link: CVE-2026-101513

cve-icon Vulnrichment

Updated: 2026-11-05T16:02:04.735Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:00.590

Modified: 2026-11-05T17:17:30.373

Link: CVE-2026-101513

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-20T21:21:17Z

Links: CVE-2026-101513 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T19:30:11Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-617

    Reachable Assertion