CVE-2026-60569

MEDIUM

MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1 - Unauthenticated Unauthorized Data Access via NDB Operator

Title source: llm

Description

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Cluster executes to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Cluster accessible data. CVSS 3.1 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

Oracle Advisory

https://www.oracle.com/security-alerts/cpujul2026.html

Scores

CVSS v3 5.1

EPSS 0.0012

EPSS Percentile 2.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-306

Status published

Products (3)

Oracle Corporation/MySQL Cluster 8.0.0 - 8.0.47

Oracle Corporation/MySQL Cluster 8.4.0 - 8.4.10

Oracle Corporation/MySQL Cluster 9.7.0 - 9.7.1

Published Jul 21, 2026

Tracked Since Jul 22, 2026