Description
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated data disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability in Oracle MySQL Connector/Python 26.7.0 enables an attacker who does not need authentication but does have network access to compromise the connector. When successfully exploited, the attacker can gain full read access to all data available through the connector, resulting in significant confidentiality loss. The CVSS 3.1 score of 7.5 reflects this impact.

Affected Systems

Oracle MySQL Connectors, specifically the Connector/Python component version 26.7.0, are affected. No other versions are listed as vulnerable.

Risk and Exploitability

The CVSS vector shows a network attack vector, low complexity, no required privileges, and no user interaction, indicating the problem can be exploited remotely with minimal effort. EPSS score of < 1%, and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact and ease of exploitation make it a significant risk for systems that expose the connector to external networks.

Generated by OpenCVE AI on October 28, 2026 at 02:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to a fixed release of Oracle MySQL Connector/Python that resolves the vulnerability
  • Restrict the connector’s network exposure by limiting access via firewall or VPN so that only trusted hosts can reach it
  • Configure monitoring and alerting for suspicious connection attempts to the connector port to detect potential exploitation attempts

Generated by OpenCVE AI on October 28, 2026 at 02:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Title Python Connector Unauthenticated Data Disclosure

Wed, 28 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Grants Full Data Access in MySQL Connector/Python 26.7.0
Weaknesses CWE-284

Tue, 27 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle mysql Connectors
Oracle Corporation
Oracle Corporation mysql Connectors
Vendors & Products Oracle mysql Connectors
Oracle Corporation
Oracle Corporation mysql Connectors

Wed, 21 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Grants Full Data Access in MySQL Connector/Python 26.7.0
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle mysql Connector\/python
CPEs cpe:2.3:a:oracle:mysql_connector\/python:26.7.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mysql Connector\/python
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Mysql Connector\/python Mysql Connectors
Oracle Corporation Mysql Connectors
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T18:43:16.741Z

Reserved: 2026-08-31T15:40:57.357Z

Link: CVE-2026-83404

cve-icon Vulnrichment

Updated: 2026-10-27T18:43:04.473Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:19:56.997

Modified: 2026-10-27T19:17:30.190

Link: CVE-2026-83404

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T03:00:15Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function