CVE-2026-22001: Oracle MySQL Server Information Disclosure

CVE-2026-22001 Overview

A vulnerability exists in the MySQL Server product of Oracle MySQL, specifically within the Server: Information Schema component. This information disclosure flaw allows an attacker with high privileges and network access to gain unauthorized read access to a subset of MySQL Server accessible data. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact

Privileged attackers with network access can exploit this vulnerability to access restricted data within MySQL Server's Information Schema, potentially exposing sensitive database metadata and configuration details.

Affected Products

• Oracle MySQL Server versions 8.0.0 through 8.0.45
• Oracle MySQL Server versions 8.4.0 through 8.4.8
• Oracle MySQL Server versions 9.0.0 through 9.6.0

Discovery Timeline

• 2026-04-21 - CVE-2026-22001 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-22001

Vulnerability Analysis

This vulnerability affects the Information Schema component of MySQL Server, which provides metadata about database objects, user privileges, and server configuration. The flaw enables information disclosure where an authenticated attacker with administrative privileges can access data they should not be authorized to view.

The vulnerability requires network access and can be exploited through multiple network protocols supported by MySQL. While the attack complexity is low, it requires high privileges (such as database administrator credentials), limiting the pool of potential attackers. The impact is confined to confidentiality, with no effect on data integrity or system availability.

Root Cause

The vulnerability stems from improper access control within the Information Schema component (CWE-200). The affected component fails to properly validate authorization for certain metadata queries, allowing privileged users to retrieve information beyond their intended access scope. This type of flaw typically occurs when privilege checks are insufficient or when query filtering mechanisms do not account for all data access paths.

Attack Vector

The attack is conducted over the network using standard MySQL protocols. An attacker must possess high-level privileges on the MySQL server to exploit this vulnerability. The attack flow involves:

1. The attacker authenticates to the MySQL server with elevated credentials
2. Specially crafted queries targeting the Information Schema are executed
3. The server returns data that should be restricted from the attacker's view
4. Sensitive metadata or configuration information is disclosed

The vulnerability does not require user interaction and affects only the confidentiality of a subset of server data. The exploitation technique involves querying specific Information Schema tables or views that expose protected information to high-privileged users who should not have access to that particular data subset.

Detection Methods for CVE-2026-22001

Indicators of Compromise

• Unusual or unexpected queries against INFORMATION_SCHEMA tables from administrative accounts
• Increased access to metadata tables such as SCHEMATA, TABLES, COLUMNS, or USER_PRIVILEGES
• Authentication logs showing administrative connections from unexpected network locations
• Anomalous patterns in query logs indicating systematic metadata enumeration

Detection Strategies

• Enable MySQL general query log or audit log plugin to capture all SQL statements executed against the server
• Monitor for bulk queries against Information Schema tables that deviate from normal administrative patterns
• Implement database activity monitoring (DAM) solutions to track privileged user behavior
• Configure alerts for administrative sessions originating from non-standard IP addresses or during unusual hours

Monitoring Recommendations

• Deploy SentinelOne Singularity XDR to monitor MySQL server processes and network connections for anomalous activity
• Implement real-time log analysis using SIEM integration to correlate MySQL audit logs with other security events
• Establish baseline query patterns for privileged accounts and alert on deviations
• Regularly review database access logs for signs of information enumeration or reconnaissance

How to Mitigate CVE-2026-22001

Immediate Actions Required

• Apply the Oracle Critical Patch Update from April 2026 to all affected MySQL Server installations
• Audit all accounts with high-level privileges and remove unnecessary administrative access
• Implement network segmentation to restrict administrative access to MySQL servers from trusted networks only
• Enable MySQL Enterprise Audit or general query logging to monitor for exploitation attempts

Patch Information

Oracle has released a security patch addressing this vulnerability as part of their April 2026 Critical Patch Update. The patch is available through the Oracle Security Alert April 2026. Administrators should upgrade to the following patched versions:

• MySQL Server 8.0.46 or later for the 8.0.x branch
• MySQL Server 8.4.9 or later for the 8.4.x branch
• MySQL Server 9.6.1 or later for the 9.x branch

Workarounds

• Implement strict network access controls limiting MySQL administrative access to specific IP addresses
• Review and minimize the number of accounts with high-level database privileges
• Use MySQL Enterprise Firewall to restrict queries against sensitive Information Schema tables
• Deploy proxy-based SQL filtering to block unauthorized metadata queries from privileged accounts

# Example: Restrict administrative access by source IP using MySQL host restrictions
# Review current user privileges
mysql> SELECT user, host FROM mysql.user WHERE Super_priv='Y';

# Modify administrative user to restrict by IP
mysql> RENAME USER 'admin'@'%' TO 'admin'@'192.168.1.0/255.255.255.0';

# Enable general query log for monitoring
mysql> SET GLOBAL general_log = 'ON';
mysql> SET GLOBAL log_output = 'TABLE';