CVE-2026-101800
Description
A flaw was found in the Security: Privileges component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact.
Statement
Red Hat Product Security rates this vulnerability as Important because an unauthenticated network adversary can alter database records or disrupt service availability, despite the elevated attack complexity involved. In standard Red Hat Enterprise Linux deployments, MySQL is not accessible to public networks by default and requires explicit configuration for remote access or replication clustering. Consequently, systems running in isolated environments or configurations where network traffic to replication endpoints is restricted face lower practical exposure.
Mitigation
To reduce exposure to this vulnerability, restrict network reachability to the MySQL database server so that only trusted hosts and application tiers can establish connections.
1. Restrict incoming traffic using firewalld to only authorized IP addresses:
bash
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_ip>" port port="3306" protocol="tcp" accept'
firewall-cmd --reload
2. If remote database connections are not required, bind the MySQL daemon to the local loopback interface by adding the following line under the `[mysqld]` section in `/etc/my.cnf` or `/etc/my.cnf.d/mysql-server.cnf`:
iniApply the configuration change by restarting the daemon:
[mysqld]
bind-address = 127.0.0.1
bash
systemctl restart mysqld
Caveats:
Restricting access to specific addresses or binding to localhost prevents unauthorized hosts from reaching the service, but external applications requiring database access must be explicitly permitted.
Warning: Modifying firewall rules or restarting the mysqld service will terminate existing database sessions and temporarily disrupt connectivity for running services.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
