Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Full system compromise via unauthenticated local access
Action: Immediate Patch
AI Analysis

Impact

An unauthenticated attacker who can reach the physical network segment of a MySQL Server or MySQL Cluster that runs Group Replication GCS can bypass authentication checks and seize control of the database instance. The flaw resides in the Group Replication GCS component and is an example of improper access control (CWE‑284) and missing authentication (CWE‑306). Successful exploitation allows the attacker to read, modify, or delete data and disrupt service availability, thereby affecting confidentiality, integrity, and availability of the database.

Affected Systems

Oracle MySQL Server versions 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1; Oracle MySQL Cluster versions 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1 are all vulnerable.

Risk and Exploitability

The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity, and an EPSS score of less than 1%, pointing to a very low but non‑zero probability of exploitation. The issue is not listed in CISA KEV. Attack requires only local physical network access (AV:A), with no authentication or privilege needed, making the compromise of the database service straightforward once the attacker is on the same segment.

Generated by OpenCVE AI on October 22, 2026 at 15:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply all vendor‑supplied patches or upgrade to the first non‑affected release (for example, MySQL Server 8.4.13 or later, 9.7.4 or later, 26.7.2 or later, and MySQL Cluster 8.0.50 or later).
  • Physically isolate the database nodes so that only trusted hosts can connect to the same network segment, preventing an attacker from gaining local access.
  • If Group Replication GCS is not required, disable the replication feature or block its network ports and monitor traffic for unauthorized replication requests.

Generated by OpenCVE AI on October 22, 2026 at 15:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Thu, 22 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Local Privilege Escalation in MySQL Group Replication mysql: mysql: Server takeover via Group Replication GCS
Weaknesses CWE-306
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 21 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Local Privilege Escalation in MySQL Group Replication
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:16:42.399Z

Reserved: 2026-09-28T15:40:09.506Z

Link: CVE-2026-101781

cve-icon Vulnrichment

Updated: 2026-10-22T15:12:26.234Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:18:33.710

Modified: 2026-10-30T14:19:11.003

Link: CVE-2026-101781

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-20T21:22:53Z

Links: CVE-2026-101781 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:45:08Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function