Description
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized read of MySQL Router data
Action: Apply Patch
AI Analysis

Impact

The MySQL Router 26.7.0 contains a flaw in its general component that permits an unauthenticated attacker who can reach the router over HTTPS to read a limited set of data exposed by the service. The attacker must rely on a third‑party user to interact with the system for the exploit to succeed. This vulnerability does not enable privilege escalation but can expose confidential information.

Affected Systems

Oracle MySQL Router version 26.7.0 is affected.

Risk and Exploitability

The CVSS v3.1 base score of 4.3 indicates a low‑to‑moderate impact, largely limited to confidentiality. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Because the exploit requires network access to HTTPS and a deliberate action by an unrelated user, the likelihood of widespread attacks is relatively low; however, the potential for data leakage warrants timely remediation.

Generated by OpenCVE AI on October 21, 2026 at 00:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Oracle MySQL Router to a newer, non‑vulnerable version.
  • If an update is not immediately available, restrict HTTPS access to the Router to trusted IP addresses or networks only.
  • Monitor Router logs for unusual read attempts and enforce strict authentication controls.

Generated by OpenCVE AI on October 21, 2026 at 00:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTPS Access Allows Unauthorized Read of MySQL Router Data
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle mysql Router
CPEs cpe:2.3:a:oracle:mysql_router:26.7.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Router
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Mysql Router
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:22:00.511Z

Reserved: 2026-09-28T15:40:09.496Z

Link: CVE-2026-101632

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:17.313

Modified: 2026-10-20T22:18:17.313

Link: CVE-2026-101632

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T00:30:12Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control