Description
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized read access leading to information exposure
Action: Apply Patch
AI Analysis

Impact

A vulnerability in Oracle MySQL Router 26.7.0 can be triggered by a low‑privileged attacker with network access via HTTPS. The flaw allows the attacker to read a subset of data that the router makes available, thereby compromising the confidentiality of that information. The CVSS 3.1 vector indicates a local privilege requirement and no user interaction, but it does not affect integrity or availability.

Affected Systems

The affected product is Oracle MySQL Router version 26.7.0. No other versions are listed as impacted by this vulnerability.

Risk and Exploitability

The CVSS base score of 4.3 reflects a moderate risk to confidentiality. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, indicating that it is not known to be actively exploited in the wild. The low access complexity and low privilege required make exploitation feasible for a network‑connected attacker, though it does not grant further control over the system.

Generated by OpenCVE AI on October 21, 2026 at 00:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle releases for a patch that addresses the MySQL Router 26.7.0 vulnerability and apply it as soon as available.
  • Restrict inbound HTTPS traffic to the Router by using firewall rules or a secure reverse proxy so that only trusted hosts can reach the vulnerable endpoint.
  • Disable or restrict any load‑balancing or proxy features that expose the Router’s data over HTTPS unless absolutely necessary, and monitor audit logs for anomalous read activity.

Generated by OpenCVE AI on October 21, 2026 at 00:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via HTTPS in Oracle MySQL Router 26.7.0
Weaknesses CWE-200
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle mysql Router
CPEs cpe:2.3:a:oracle:mysql_router:26.7.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Router
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Mysql Router
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:22:00.960Z

Reserved: 2026-09-28T15:40:09.496Z

Link: CVE-2026-101633

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:17.427

Modified: 2026-10-20T22:18:17.427

Link: CVE-2026-101633

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T00:30:12Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-285

    Improper Authorization