CVE-2026-60171: MySQL Cluster DOS Vulnerability

CVE-2026-60171 Overview

CVE-2026-60171 is a denial of service vulnerability in the Oracle MySQL Cluster product, specifically within the Server: Optimizer component. The flaw affects supported versions 8.0.0 through 8.0.47. An authenticated attacker with high privileges and network access via multiple protocols can exploit this issue to cause a hang or repeatable crash of MySQL Cluster. The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption. Oracle disclosed the issue in the Oracle Critical Patch Update advisory for July 2026.

Critical Impact
Successful exploitation results in a complete denial of service of MySQL Cluster, disrupting availability of database-dependent applications and services.

Affected Products

Oracle MySQL Cluster 8.0.0 through 8.0.47
Component: Server: Optimizer
Deployments exposing MySQL Cluster over network protocols to privileged accounts

Discovery Timeline

2026-07-21 - CVE-2026-60171 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60171

Vulnerability Analysis

The vulnerability resides in the query optimizer subsystem of MySQL Cluster. The optimizer is responsible for evaluating SQL statements and selecting execution plans. A defect in this component allows a high-privileged authenticated user to submit crafted requests that cause uncontrolled resource consumption. The result is a process hang or a repeatable crash that terminates database availability.

The issue is cataloged under [CWE-400] Uncontrolled Resource Consumption. Oracle rates the flaw as impacting availability only, with no confidentiality or integrity impact. The EPSS probability at publication is 0.422%, indicating limited observed exploitation likelihood at this time.

Root Cause

The root cause is improper handling of resource limits during query optimization. When the optimizer processes specific query patterns, it fails to bound its internal operations, leading to exhaustion of memory, CPU, or thread resources. Because the failure occurs inside a cluster-critical path, the impact extends beyond a single session to the entire MySQL Cluster instance.

Attack Vector

Exploitation requires network access to the MySQL Cluster service and valid credentials for a high-privileged account. The attacker submits crafted SQL statements over supported protocols to trigger the optimizer defect. No user interaction is required, and attack complexity is low once authentication is achieved. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-60171

Indicators of Compromise

Unexpected MySQL Cluster daemon crashes or restarts recorded in mysqld error logs
Sudden spikes in memory or CPU usage on cluster data nodes preceding a hang
Repeated abnormal query patterns from a single privileged account followed by service disruption
Failed replication or NDB API disconnections coinciding with optimizer errors

Detection Strategies

Enable MySQL general query log and slow query log to capture statements executed by privileged accounts prior to a crash
Correlate mysqld process termination events with preceding SQL activity to identify trigger queries
Monitor NDB cluster management logs for node failure events and forced restarts

Monitoring Recommendations

Alert on repeated mysqld restarts within short time windows on cluster nodes
Track authentication events for high-privileged accounts and correlate with resource exhaustion metrics
Baseline normal optimizer statistics and alert on anomalous query plan complexity or execution time

How to Mitigate CVE-2026-60171

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for MySQL Cluster as documented in the Oracle Security Alert July 2026
Inventory all MySQL Cluster deployments running versions 8.0.0 through 8.0.47 and prioritize patching
Review and reduce the number of accounts holding high database privileges

Patch Information

Oracle addressed CVE-2026-60171 as part of the Critical Patch Update released in July 2026. Administrators should upgrade affected MySQL Cluster installations to the fixed release specified in the advisory. Verify patch application by confirming the running server version reports a build later than 8.0.47.

Workarounds

Restrict network access to MySQL Cluster listeners to trusted management hosts via firewall rules
Enforce least privilege by revoking unnecessary administrative roles from application service accounts
Rotate credentials for privileged database users and require multi-factor authentication on jump hosts

bash

# Example: restrict MySQL Cluster ports to a trusted admin subnet
iptables -A INPUT -p tcp --dport 3306 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1186 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
iptables -A INPUT -p tcp --dport 1186 -j DROP