CVE-2025-30710: Oracle MySQL Cluster DOS Vulnerability

CVE-2025-30710 Overview

CVE-2025-30710 is a denial-of-service vulnerability in the Oracle MySQL Cluster product, specifically within the NDBCluster plugin component. The flaw affects MySQL Cluster versions 8.0.0-8.0.41, 8.4.0-8.4.4, and 9.0.0-9.2.0. An authenticated attacker with high privileges and network access can exploit the issue through multiple protocols to trigger a hang or repeatable crash of the MySQL Cluster service. Oracle addressed the vulnerability in the April 2025 Critical Patch Update. The weakness is classified under CWE-284 (Improper Access Control).

Critical Impact
Successful exploitation results in complete denial of service against the MySQL Cluster instance, disrupting availability for all dependent applications and services.

Affected Products

Oracle MySQL Cluster 8.0.0 through 8.0.41
Oracle MySQL Cluster 8.4.0 through 8.4.4
Oracle MySQL Cluster 9.0.0 through 9.2.0

Discovery Timeline

2025-04-15 - Oracle publishes the vulnerability in the April 2025 Critical Patch Update
2025-04-15 - CVE-2025-30710 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30710

Vulnerability Analysis

The vulnerability resides in the NDBCluster storage engine plugin of MySQL Cluster. This plugin provides the distributed, shared-nothing storage layer that distinguishes MySQL Cluster from standalone MySQL deployments. Improper access control within the plugin allows an authenticated attacker holding elevated privileges to submit crafted requests that place the cluster into an unrecoverable state.

Exploitation causes the cluster to hang or crash in a repeatable manner, producing a complete denial of service. Confidentiality and integrity are not affected, but availability loss is total for the impacted node. Because MySQL Cluster is commonly deployed as the backend for latency-sensitive workloads such as telecom subscriber databases and online transaction processing, service interruption cascades quickly to dependent applications.

Root Cause

The root cause is classified as improper access control [CWE-284] within the NDBCluster plugin. The plugin fails to properly validate or restrict specific privileged operations, allowing a high-privileged user session to reach a code path that terminates or deadlocks the cluster process. Oracle has not published component-level technical details beyond the advisory summary.

Attack Vector

The attacker must have network reachability to the MySQL Cluster service and an authenticated session with high privileges. Oracle indicates the vulnerability is exploitable across multiple protocols supported by MySQL Cluster. No user interaction is required, and attack complexity is low. The EPSS probability is 0.622% with a percentile of 47.996, reflecting a low observed likelihood of near-term exploitation.

Because authentication with elevated rights is required, the primary risk profile involves insider misuse, compromised administrative credentials, or lateral movement from an application account granted overly broad database privileges. Refer to the Oracle Critical Patch Update April 2025 for advisory-level details.

Detection Methods for CVE-2025-30710

Indicators of Compromise

Unexpected termination or hang events of ndbd or ndbmtd data node processes on MySQL Cluster hosts.
Repeated cluster failover or restart events without corresponding maintenance activity.
Administrative-level MySQL sessions originating from unusual source IP addresses or service accounts.

Detection Strategies

Monitor MySQL Cluster management node logs (ndb_*_cluster.log) and data node logs for abnormal shutdown, watchdog, or trace events.
Correlate high-privileged authentication events (SUPER, NDB_STORED_USER) with subsequent cluster instability.
Baseline normal query and administrative traffic to the cluster, then alert on anomalous protocol usage against NDBCluster endpoints.

Monitoring Recommendations

Forward MySQL Cluster logs and audit plugin output to a centralized SIEM for retention and correlation.
Enable the MySQL Enterprise Audit plugin or an equivalent audit log to record privileged statement execution.
Track cluster health metrics such as node state transitions, arbitration events, and data node restarts through Prometheus or Oracle Enterprise Manager.

How to Mitigate CVE-2025-30710

Immediate Actions Required

Apply the April 2025 Oracle Critical Patch Update to all MySQL Cluster nodes running affected versions.
Audit accounts holding high-level MySQL Cluster privileges and revoke rights that are not operationally required.
Restrict network access to MySQL Cluster management, data, and SQL nodes to trusted administrative subnets only.

Patch Information

Oracle released fixes as part of the April 2025 Critical Patch Update. Administrators should upgrade to a MySQL Cluster release later than 8.0.41, 8.4.4, or 9.2.0 within each supported branch. Consult the Oracle Critical Patch Update April 2025 advisory for exact fixed version numbers and download locations.

Workarounds

Enforce least privilege on database accounts and remove SUPER, NDB_STORED_USER, and cluster administrative privileges from application service accounts.
Place MySQL Cluster protocol ports behind firewalls or bastion hosts, blocking direct exposure to general corporate or internet networks.
Require multi-factor authentication and jump-host access for administrators authorized to hold high-privilege cluster roles.

bash

# Example: restrict cluster ports to a trusted management subnet
iptables -A INPUT -p tcp --dport 1186 -s 10.10.20.0/24 -j ACCEPT   # NDB management
iptables -A INPUT -p tcp --dport 2202 -s 10.10.20.0/24 -j ACCEPT   # NDB data node
iptables -A INPUT -p tcp --dport 3306 -s 10.10.20.0/24 -j ACCEPT   # MySQL SQL node
iptables -A INPUT -p tcp --dport 1186 -j DROP
iptables -A INPUT -p tcp --dport 2202 -j DROP
iptables -A INPUT -p tcp --dport 3306 -j DROP