Auth bypass in Oracle MySQL Cluster
CVE-2026-60569
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Cluster executes to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Cluster accessible data. CVSS 3.1 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Vulnerability class: Broken Authentication
EPSS: 0.001 (4.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.1 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Oracle Mysql_cluster — versions 9.7.0, 9.7.1
- Oracle Corporation Mysql Cluster — versions 8.0.0, 8.4.0, 9.7.0
Weakness classification (CWE)
References
- secalert_us@oracle.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-60569?
- CVE-2026-60569 is a medium-severity vulnerability in Oracle MySQL Cluster, classified under Missing Authentication for Critical Function. CVSS score: 5.1/10. Published 2026-07-21.
- How severe is CVE-2026-60569?
- Medium severity. CVSS v3 base score is 5.1 out of 10.