Description
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized read access leading to information exposure
Action: Apply Patch
AI Analysis

Impact

A vulnerability in Oracle MySQL Router 26.7.0 can be triggered by a low‑privileged attacker with network access via HTTPS. The flaw allows the attacker to read a subset of data that the router makes available, thereby compromising the confidentiality of that information. The CVSS 3.1 vector indicates a low access complexity, a low privilege requirement, no user interaction, and no impact on integrity or availability.

Affected Systems

The affected product is Oracle MySQL Router version 26.7.0. No other versions are listed as impacted by this vulnerability.

Risk and Exploitability

The CVSS base score of 4.3 reflects a moderate risk to confidentiality. The EPSS score of <1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. The low access complexity and low privilege required make exploitation feasible for a network‑connected attacker, though it does not grant further control over the system.

Generated by OpenCVE AI on October 22, 2026 at 12:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle releases for a patch that addresses the MySQL Router 26.7.0 vulnerability and apply it as soon as available.
  • Restrict inbound HTTPS traffic to the Router by using firewall rules or a secure reverse proxy so that only trusted hosts can reach the vulnerable endpoint.
  • Disable or restrict any load‑balancing or proxy features that expose the Router’s data over HTTPS unless absolutely necessary, and monitor audit logs for anomalous read activity.

Generated by OpenCVE AI on October 22, 2026 at 12:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Title Limited Data Disclosure via Low-Privilege HTTPS Access in MySQL Router 26.7.0

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via HTTPS in Oracle MySQL Router 26.7.0
Weaknesses CWE-200
CWE-285

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via HTTPS in Oracle MySQL Router 26.7.0
Weaknesses CWE-200
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle mysql Router
CPEs cpe:2.3:a:oracle:mysql_router:26.7.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Router
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Mysql Router
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T18:35:44.794Z

Reserved: 2026-09-28T15:40:09.496Z

Link: CVE-2026-101633

cve-icon Vulnrichment

Updated: 2026-10-21T18:19:42.622Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:17.427

Modified: 2026-10-21T19:16:52.027

Link: CVE-2026-101633

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T01:00:17Z

Weaknesses