Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-10-20T21:22:59 mysql: mysql: Complete server takeover via replication component 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-400

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

A flaw was found in the Replication component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact.

This vulnerability is rated Important because an attacker could achieve complete compromise of the database instance and its hosted data, although the risk is bounded below Critical by the requirement for user interaction and high attack complexity. In typical Red Hat Enterprise Linux environments, database replication interfaces are confined to isolated internal networks rather than exposed to untrusted external traffic. Deployments that do not actively participate in replication topologies or process untrusted replication traffic remain largely unaffected by this issue. Red Hat Enterprise Linux 10 Affected mysql8.4 Red Hat Enterprise Linux 6 Not affected mysql Red Hat Enterprise Linux 9 Affected mysql Red Hat Hardened Images Not affected mariadb10.11 Red Hat Hardened Images Not affected mariadb11.8 https://www.cve.org/CVERecord?id=CVE-2026-101796 https://nvd.nist.gov/vuln/detail/CVE-2026-101796 https://www.oracle.com/security-alerts/cpuoct2026.html