Description
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Published: 2026-07-21
Score: 2.9 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Pluggable Auth component of Oracle MySQL Server and MySQL Cluster enables an attacker who has access to the underlying host to modify database contents. The vulnerability does not reveal data or interrupt service; it only permits unauthorized updates, inserts, or deletes, thereby compromising data integrity. The weakness is an improper access control failure (CWE‑284).

Affected Systems

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, and Oracle MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1 are affected. All other releases are not listed as vulnerable.

Risk and Exploitability

The CVSS 3.1 base score of 2.9 indicates low severity, and an EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability requires local access to the machine hosting MySQL, so remote exploitation is not possible. The risk level is low and the issue is not currently listed in CISA’s KEV catalog.

Generated by OpenCVE AI on August 2, 2026 at 19:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle MySQL patch or upgrade to a version outside the affected ranges.
  • If no patch is available, restrict local access to the host running MySQL by enforcing strict OS‑level permissions and ensuring the MySQL process runs under a least‑privilege account.
  • Disable or remove the Pluggable Auth plugin when it is not needed, as the vulnerability operates through this component.

Generated by OpenCVE AI on August 2, 2026 at 19:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Pluggable Auth Vulnerability in Oracle MySQL mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026)
Weaknesses CWE-266
References
Metrics threat_severity

None

 threat_severity

Low

Fri, 24 Jul 2026 19:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Pluggable Auth Vulnerability in Oracle MySQL
Weaknesses CWE-285

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
First Time appeared Oracle
Oracle mysql Cluster
Oracle mysql Server
CPEs cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Cluster
Oracle mysql Server
References
Metrics cvssV3_1

{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Oracle Mysql Cluster Mysql Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T19:17:21.843Z

Reserved: 2026-07-08T15:51:55.613Z

Link: CVE-2026-61096

cve-icon Vulnrichment

Updated: 2026-07-23T19:17:08.595Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-21T00:00:00Z

Links: CVE-2026-61096 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T20:00:12Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control