CVE-2026-46861: MySQL NDB Cluster Privilege Escalation

CVE-2026-46861 Overview

CVE-2026-46861 is a critical access control vulnerability in the Oracle MySQL NDB Cluster product, specifically within the NDB Operator component. The flaw affects MySQL NDB Cluster versions 8.0.11-8.0.46, 8.4.0-8.4.9, and 9.0.0-9.7.0. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise the cluster. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the vulnerable component itself. Oracle disclosed the issue in the June 2026 Critical Patch Update advisory.

Critical Impact
Successful exploitation grants unauthorized creation, deletion, or modification of critical data and complete read access to all data accessible through MySQL NDB Cluster.

Affected Products

Oracle MySQL NDB Cluster versions 8.0.11 through 8.0.46
Oracle MySQL NDB Cluster versions 8.4.0 through 8.4.9
Oracle MySQL NDB Cluster versions 9.0.0 through 9.7.0

Discovery Timeline

2026-06-17 - CVE-2026-46861 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-46861

Vulnerability Analysis

The vulnerability resides in the NDB Operator component of MySQL NDB Cluster, the Kubernetes operator that manages NDB Cluster deployments. The issue is classified under CWE-284: Improper Access Control. An authenticated low-privileged attacker can reach the operator over HTTP and perform operations that should require higher privileges. Because the operator manages cluster-wide state, the impact extends beyond the operator process itself and changes the security scope. Confidentiality and integrity of all data managed by the cluster are at risk, while availability is not directly affected.

Root Cause

The root cause is improper enforcement of access control in the NDB Operator's HTTP-exposed interfaces. The operator does not adequately validate that requesting principals hold the privileges required to perform sensitive cluster operations. This allows accounts with minimal permissions to invoke operations that read or modify data outside their intended authorization boundary.

Attack Vector

Exploitation requires network reachability to the NDB Operator HTTP endpoint and any low-privileged credential accepted by that interface. No user interaction is required, and attack complexity is low. Once authenticated, the attacker issues HTTP requests that drive the operator to create, modify, or delete data, or to read data the attacker should not access. Because exploitation crosses a security scope, the impact extends to all data the cluster can reach, not only the operator's own resources.

No public proof-of-concept code is available. See the Oracle Security Alert for vendor-provided technical context.

Detection Methods for CVE-2026-46861

Indicators of Compromise

Unexpected HTTP requests to NDB Operator endpoints from low-privileged service accounts or pods.
NDB Cluster schema or data modifications that do not map to authorized change tickets or deployment pipelines.
Operator audit log entries showing privileged actions originating from non-administrative identities.
Outbound data transfers from NDB Cluster nodes to unexpected destinations.

Detection Strategies

Enable verbose audit logging on the NDB Operator and forward events to a centralized log platform for correlation.
Baseline normal operator API call patterns and alert on deviations such as bulk read, delete, or schema-modification operations.
Inspect Kubernetes API server and ingress logs for HTTP requests targeting NDB Operator paths from unusual source identities.

Monitoring Recommendations

Continuously monitor MySQL NDB Cluster query patterns for anomalous INSERT, UPDATE, DELETE, and large SELECT operations.
Track changes to operator-managed custom resources and reconcile against approved GitOps state.
Alert on privilege use that crosses tenant or namespace boundaries within the cluster environment.

How to Mitigate CVE-2026-46861

Immediate Actions Required

Apply the Oracle Critical Patch Update from June 2026 to all MySQL NDB Cluster deployments running affected versions.
Inventory all NDB Operator instances and confirm version levels against the affected ranges 8.0.11-8.0.46, 8.4.0-8.4.9, and 9.0.0-9.7.0.
Restrict network exposure of NDB Operator HTTP endpoints to administrative networks only.
Rotate credentials and tokens used to authenticate against the NDB Operator after patching.

Patch Information

Oracle addressed CVE-2026-46861 in the June 2026 Critical Patch Update. Upgrade to a fixed release beyond the affected ranges as documented in the Oracle Security Alert. Validate the upgrade in a staging cluster before rolling out to production, and confirm operator reconciliation against existing NDB Cluster custom resources.

Workarounds

Apply network policies that limit ingress to the NDB Operator to trusted administrative pods and namespaces.
Enforce least-privilege role bindings on accounts that interact with the NDB Operator, removing any unnecessary HTTP access.
Place the operator behind an authenticated reverse proxy that performs additional authorization checks until patching is complete.

bash

# Example: restrict NDB Operator ingress via Kubernetes NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ndb-operator-restrict
  namespace: mysql-cluster
spec:
  podSelector:
    matchLabels:
      app: ndb-operator
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              role: cluster-admin
      ports:
        - protocol: TCP
          port: 8443