CVE-2026-101781
Description
A flaw was found in MySQL's Group Replication Group Communication System (GCS). An unauthenticated attacker located on the same adjacent network segment can exploit this vulnerability without requiring privileges or user interaction. Successful exploitation allows the attacker to take over the MySQL server, leading to unauthorized data disclosure, data modification, and denial of service.
Statement
This vulnerability is rated as Important because an unauthenticated adjacent attacker can achieve complete system compromise without requiring prior privileges or user interaction. Standard MySQL installations on Red Hat Enterprise Linux do not enable Group Replication by default, leaving typical standalone deployments unaffected. Risk is confined to environments where Group Replication is actively configured and group communication ports are accessible from untrusted adjacent networks.
Mitigation
Restrict network exposure by limiting communication on the Group Replication port to authorized cluster nodes using firewalld, or disable the Group Replication feature if it is not required.
1. Restrict the replication communication port (default TCP 33061) to trusted cluster peer IPs using firewalld:
# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<PEER_NODE_IP>" port port="33061" protocol="tcp" accept'
# firewall-cmd --reload
2. Alternatively, if Group Replication is not required, stop the plugin within MySQL:
mysql> STOP GROUP_REPLICATION;
Ensure that `plugin-load` or `group_replication` startup parameters are removed or disabled in the MySQL configuration files under `/etc/my.cnf` or `/etc/my.cnf.d/`.
Caveats: Limiting network access requires specifying all legitimate member addresses; misconfiguration may prevent nodes from joining the replication cluster.
Warning: Reloading firewall rules or stopping the replication service will temporarily interrupt replication traffic and cluster synchronization.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Adjacent Network | N/A | Adjacent Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
