CVE-2026-60163: MySQL Server Privilege Escalation Flaw

CVE-2026-60163 Overview

CVE-2026-60163 is a high-severity vulnerability in the Group Replication Plugin component of Oracle MySQL Server and MySQL Cluster. The flaw allows an unauthenticated attacker with local logon access to the infrastructure hosting MySQL to compromise the database service. Successful exploitation results in full takeover of MySQL Server or MySQL Cluster, impacting confidentiality, integrity, and availability. The weakness is classified under [CWE-284] Improper Access Control. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Local unauthenticated attackers can take over MySQL Server and MySQL Cluster instances running the Group Replication Plugin, leading to complete loss of database confidentiality, integrity, and availability.

Affected Products

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 8.0.0 through 8.0.47 and 8.4.0 through 8.4.10
Oracle MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - Oracle publishes advisory in the July 2026 Critical Patch Update
2026-07-21 - CVE-2026-60163 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60163

Vulnerability Analysis

The vulnerability resides in the Group Replication Plugin of Oracle MySQL Server and MySQL Cluster. Group Replication provides distributed state machine replication with strong coordination between server instances. An unauthenticated attacker who has local logon access to the underlying host running MySQL can leverage a flaw in this plugin to compromise the database process. The attack path does not require database credentials or user interaction. Successful exploitation grants the attacker full control over the affected MySQL Server or Cluster instance. The Exploit Prediction Scoring System (EPSS) probability is 0.164%, indicating low observed exploitation activity at publication time.

Root Cause

The root cause is improper access control [CWE-284] within the Group Replication Plugin. The plugin fails to sufficiently restrict operations exposed to local processes on the host. This gap enables a local actor without database authentication to interact with replication logic in ways that lead to service takeover.

Attack Vector

Exploitation requires local access to the infrastructure where MySQL Server or MySQL Cluster runs. The attacker does not need MySQL credentials and does not need to trick a user into performing any action. Attack complexity is low, and the scope remains unchanged. Environments that expose shell access on database hosts to multiple users or workloads are at higher risk.

No public proof-of-concept exploit code has been released. Refer to the Oracle Security Alert - July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60163

Indicators of Compromise

Unexpected mysqld child processes or shell spawns originating from the MySQL Server process on hosts running Group Replication
Unauthorized modifications to mysql.gtid_executed, replication metadata, or Group Replication membership state
New or altered MySQL user accounts with elevated privileges that were not created through change management
Anomalous local logons on database hosts followed by MySQL service restarts or configuration reloads

Detection Strategies

Inventory all MySQL Server and MySQL Cluster hosts and confirm whether the Group Replication Plugin (group_replication.so) is loaded via SHOW PLUGINS
Correlate local shell activity on database hosts with MySQL error log entries referencing group_replication events
Monitor for unauthorized changes to plugin_dir, mysqld.cnf, and Group Replication system variables such as group_replication_group_name

Monitoring Recommendations

Enable MySQL audit logging and forward mysql-error.log plus audit events to a centralized log platform
Alert on privilege changes, plugin load or unload events, and Group Replication view changes outside maintenance windows
Track local authentication events on database hosts, including sudo, su, and SSH sessions tied to service accounts

How to Mitigate CVE-2026-60163

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to all affected MySQL Server and MySQL Cluster deployments
Restrict local logon on database hosts to a minimal set of administrative accounts and remove interactive access for shared or application users
Audit and rotate credentials for any account that had local access to affected hosts prior to patching

Patch Information

Oracle released patched builds as part of the July 2026 Critical Patch Update. Administrators should upgrade MySQL Server past 8.4.10 and 9.7.1, and MySQL Cluster past 8.0.47, 8.4.10, and 9.7.1 to the fixed versions listed in the Oracle Security Alert - July 2026.

Workarounds

Where immediate patching is not feasible, disable the Group Replication Plugin on instances that do not require it using UNINSTALL PLUGIN group_replication
Enforce host-level isolation by placing MySQL nodes on dedicated systems with no non-administrative local users
Apply mandatory access controls such as SELinux or AppArmor profiles to constrain the mysqld process and its interactions with local users

bash

# Verify plugin status and disable if unused, pending patch deployment
mysql -u root -p -e "SHOW PLUGINS;" | grep -i group_replication
mysql -u root -p -e "UNINSTALL PLUGIN group_replication;"

# Restrict interactive logon on the database host
sudo passwd -l shared_service_account
sudo sed -i 's/^AllowUsers.*/AllowUsers dbadmin/' /etc/ssh/sshd_config
sudo systemctl restart sshd