CVE-2026-46860: MySQL Router Auth Bypass Vulnerability

CVE-2026-46860 Overview

CVE-2026-46860 is a critical access control vulnerability in Oracle MySQL Router affecting versions 9.0.0 through 9.7.0. The flaw allows an unauthenticated attacker with network access via HTTP to compromise MySQL Router. Successful exploitation results in complete takeover of the affected MySQL Router instance, impacting confidentiality, integrity, and availability.

The vulnerability is categorized under [CWE-284] Improper Access Control. Oracle addressed the issue in the June 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can take over MySQL Router instances through HTTP, enabling interception or manipulation of database routing for backend MySQL clusters.

Affected Products

Oracle MySQL Router 9.0.0
Oracle MySQL Router versions 9.0.0 through 9.7.0
Deployments exposing MySQL Router HTTP interfaces to untrusted networks

Discovery Timeline

2026-06-17 - CVE-2026-46860 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-46860

Vulnerability Analysis

MySQL Router is a lightweight middleware that provides transparent routing between application clients and MySQL InnoDB Cluster backends. The vulnerability resides in the Router: General component and is exposed through the HTTP interface used for management and health endpoints.

The flaw permits an unauthenticated network attacker to bypass intended access controls. An attacker who reaches the HTTP listener can compromise the Router process with full impact on confidentiality, integrity, and availability. According to Oracle, exploitation is rated low complexity and requires no privileges or user interaction.

EPSS data places exploitation probability at 0.522% with a percentile of 40.107 as of 2026-06-18. No public exploit code or proof-of-concept has been observed at the time of publication.

Root Cause

The root cause is improper access control [CWE-284] within the MySQL Router HTTP interface. Oracle's advisory indicates that affected versions fail to correctly enforce authorization on requests reaching the management surface, allowing unauthenticated callers to invoke privileged functionality.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted requests to the exposed Router HTTP listener without authenticating. No client-side interaction is required, and the scope remains unchanged, meaning impact is confined to the MySQL Router security boundary. Because Router brokers connections to backend MySQL instances, takeover can lead to downstream credential theft, query manipulation, and service disruption.

No verified exploit code is publicly available. Refer to the Oracle Security Alert for vendor technical details.

Detection Methods for CVE-2026-46860

Indicators of Compromise

Unexpected HTTP requests to MySQL Router management endpoints from external or non-administrative source addresses
New or modified Router configuration files, routing rules, or REST API users that were not provisioned by administrators
Anomalous outbound connections from Router hosts to backend MySQL servers outside normal application traffic patterns
Router process restarts, crashes, or log entries indicating authentication or authorization anomalies

Detection Strategies

Inventory all MySQL Router deployments and confirm whether their HTTP interfaces are reachable from outside the application tier
Compare running Router binary versions against the affected range (9.0.0–9.7.0) using configuration management tooling
Inspect Router access and error logs for unauthenticated requests to administrative paths or unusual user-agent strings
Correlate HTTP traffic to Router with downstream MySQL audit logs to identify unauthorized routing changes

Monitoring Recommendations

Alert on any HTTP connection to MySQL Router from networks outside the documented application subnet
Forward Router logs to a centralized SIEM and create rules for repeated failed access or schema changes to routing metadata
Baseline normal Router REST API usage and trigger alerts when call patterns or source identities deviate

How to Mitigate CVE-2026-46860

Immediate Actions Required

Apply the June 2026 Oracle Critical Patch Update to upgrade MySQL Router beyond the affected 9.0.0–9.7.0 range
Restrict network access to the Router HTTP interface to trusted management hosts using firewall or security group rules
Rotate any credentials, certificates, or routing secrets that may have been exposed on potentially compromised Router hosts
Audit Router configuration files and REST API user lists for unauthorized modifications

Patch Information

Oracle published fixes in the June 2026 Critical Patch Update. Customers should consult the Oracle Security Alert for fixed version identifiers and upgrade guidance specific to their MySQL Router deployment.

Workarounds

Disable the MySQL Router HTTP interface where it is not required for operations
Bind the Router HTTP listener to localhost or a dedicated management interface rather than all interfaces
Place Router behind a reverse proxy or network ACL that enforces authentication and source IP restrictions until patching is complete

bash

# Configuration example: restrict Router HTTP listener in mysqlrouter.conf
[http_server]
bind_address=127.0.0.1
port=8443
ssl=1
require_realm=default_auth_realm