CVE-2026-101722
Description
A flaw was found in the MySQL connection handling component. A remote attacker with low privileges and network access can exploit this vulnerability using multiple protocols. Successful exploitation results in unauthorized read access to a subset of database data, leading to information disclosure.
Statement
Red Hat evaluates this vulnerability as having a Moderate security impact because exploitation requires existing authenticated credentials, and the blast radius is confined to partial data read access without the ability to modify records or cause a denial of service. In standard enterprise deployments, supported Red Hat Enterprise Linux releases do not ship the affected upstream branches containing this connection handling routine. Consequently, default production systems remain unaffected.
Mitigation
Limit network access to the database service to authorized hosts only, or bind the daemon to localhost when external access is not necessary.
To restrict connections using firewalld to a trusted source network:
# firewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24
# firewall-cmd --permanent --remove-service=mysql
# firewall-cmd --reload
Alternatively, to restrict the daemon to local connections only, specify the loopback address in the database configuration file (for example, `/etc/my.cnf` under the `[mysqld]` section):
bind-address = 127.0.0.1
Then restart the service:
# systemctl restart mysqld
Warning: Applying firewall changes or modifying service configuration requires reloading firewalld or restarting the database service, which will terminate active connections. Limiting network reachability or binding to localhost prevents remote clients from establishing database connections.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | 4.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
