Description
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: Confidentiality and integrity compromise
Action: Patch
AI Analysis

Impact

The vulnerability resides in the Router: General component of Oracle MySQL Router and allows an unauthenticated attacker who can reach the router over HTTPS to create, delete, or modify router‑exposed data. This improper access control (CWE-284) leads to both confidentiality and integrity risks. The flaw is considered moderate severity (CVSS 3.1 base score 6.8) and requires the attacker to persuade a different human to interact, indicating that exploitation is difficult yet possible.

Affected Systems

Oracle MySQL Router version 26.7.0 is affected. No other versions are listed as vulnerable.

Risk and Exploitability

The CVSS score of 6.8 signals a moderate risk, and no EPSS data is available while the vulnerability is not listed in the CISA KEV catalog. The attack vector is network HTTPS, unauthenticated but demanding a separate human interaction. Although the high attack complexity lowers exploit likelihood, the potential to compromise critical data warrants timely remediation.

Generated by OpenCVE AI on October 21, 2026 at 00:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Oracle MySQL Router to a patched release that removes the vulnerability.
  • If an upgrade is unavailable, restrict HTTPS access to trusted IP ranges or VPNs only.
  • Disable the HTTPS interface on the router until a fix is deployed.
  • Continuously monitor security logs for signs of unauthorized data manipulation.

Generated by OpenCVE AI on October 21, 2026 at 00:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTPS Access in Oracle MySQL Router Enables Unauthorized Data Manipulation
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle mysql Router
CPEs cpe:2.3:a:oracle:mysql_router:26.7.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Router
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Mysql Router
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:22:00.141Z

Reserved: 2026-09-28T15:40:09.496Z

Link: CVE-2026-101631

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:17.200

Modified: 2026-10-20T22:18:17.200

Link: CVE-2026-101631

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T00:30:12Z

Weaknesses