Description
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.37. Difficult to exploit vulnerability allows physical access to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 3.8 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 3.8 Low
EPSS: n/a
KEV: No
Impact: Availability - Denial of Service
Action: Apply Patch
AI Analysis

Impact

A vulnerability exists in the InnoDB component of Oracle MySQL Cluster that requires a user to have physical access and high local privileges. An attacker who can reach the server can exploit the flaw in a way that causes the cluster to hang or crash repeatedly, resulting in a denial of service that affects the availability of the database service.

Affected Systems

Oracle MySQL Cluster versions 8.0.0 through 8.0.37 are affected. No other products or newer major releases are listed as vulnerable.

Risk and Exploitability

The CVSS base score of 3.8 reflects an attack vector of physical access, high privilege, and no user interaction, and indicates availability impact only. Because exploitation requires physical presence on the host and high privileges, it is difficult to exploit remotely or without direct access. EPSS data is not provided and the vulnerability is not in CISA’s KEV catalog, suggesting a low probability of widespread exploitation at present. The potential impact, however, remains that the database cluster can be rendered unavailable indefinitely until a restart or patch is applied.

Generated by OpenCVE AI on October 21, 2026 at 05:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MySQL Cluster to a version that contains the fix for the InnoDB issue.
  • Restrict physical and local administrative access to the servers running MySQL Cluster so that only trusted personnel can log on or physically reach the machines.
  • Configure monitoring of MySQL Cluster logs and system metrics to detect hangs or crashes, and set up alerts to notify administrators of abnormal shutdowns.

Generated by OpenCVE AI on October 21, 2026 at 05:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.37. Difficult to exploit vulnerability allows physical access to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 3.8 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle mysql Cluster
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
References
Metrics cvssV3_1

{'score': 3.8, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Mysql Cluster
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:17.571Z

Reserved: 2026-09-28T15:40:09.488Z

Link: CVE-2026-101513

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:00.590

Modified: 2026-10-20T22:18:00.590

Link: CVE-2026-101513

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T01:30:16Z

Weaknesses

No weakness.