CVE-2026-61096

LOW

MySQL Server and MySQL Cluster - Unauthenticated Data Manipulation via Pluggable Authentication

Title source: llm

Description

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

Oracle Advisory

https://www.oracle.com/security-alerts/cpujul2026.html

Scores

CVSS v3 2.9

EPSS 0.0013

EPSS Percentile 3.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284

Status published

Products (11)

oracle/mysql_cluster 9.7.0

oracle/mysql_cluster 9.7.1

oracle/mysql_cluster 8.0.0 - 8.0.47

oracle/mysql_server 9.7.0

oracle/mysql_server 9.7.1

oracle/mysql_server 8.4.0 - 8.4.10

Oracle Corporation/MySQL Cluster 8.0.0-8.0.47

Oracle Corporation/MySQL Cluster 8.4.0-8.4.10

Oracle Corporation/MySQL Cluster 9.7.0-9.7.1

Oracle Corporation/MySQL Server 8.4.0-8.4.10

... and 1 more

Published Jul 21, 2026

Tracked Since Jul 22, 2026