CVE-2026-60177: MySQL Server Clone Plugin DOS Vulnerability

CVE-2026-60177 Overview

CVE-2026-60177 is a denial of service vulnerability in the Clone Plugin component of Oracle MySQL Server and MySQL Cluster. The flaw allows a high-privileged attacker with network access via multiple protocols to trigger a hang or repeatable crash, resulting in complete denial of service. The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption. Oracle disclosed the issue in the July 2026 Critical Patch Update. Affected releases include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, along with MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Exploitation is rated as difficult but network-reachable.

Critical Impact
Successful exploitation causes a complete availability loss of MySQL Server or MySQL Cluster instances through server hang or repeatable crash.

Affected Products

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 8.0.0 through 8.0.47
Oracle MySQL Cluster versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE CVE-2026-60177 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60177

Vulnerability Analysis

The vulnerability resides in the MySQL Server Clone Plugin, which supports physical snapshot-based data cloning between MySQL instances. An attacker with high privileges and network reachability can send crafted input over MySQL-supported protocols to trigger uncontrolled resource consumption. The result is either a persistent hang or a crash that recurs whenever the trigger condition is met. Because the crash is described as frequently repeatable, restart-only remediation does not restore availability if the trigger is reissued.

The issue affects only availability. Confidentiality and integrity are not impacted, and no data leakage or privilege escalation is associated with this flaw.

Root Cause

The defect maps to [CWE-400] Uncontrolled Resource Consumption within the Clone Plugin code path. The plugin does not adequately constrain resource allocation or state handling when processing certain requests, permitting a malformed or adversarial sequence to exhaust resources or enter an unrecoverable state.

Attack Vector

Exploitation requires an attacker who already holds high privileges within MySQL and has network access to the server. The attacker invokes Clone Plugin operations through a MySQL protocol connection. Attack complexity is high, indicating the attacker must satisfy specific runtime conditions to reliably trigger the crash. No user interaction is required.

Exploitation code is not publicly available at this time. Refer to the Oracle Critical Patch Update - July 2026 for the authoritative advisory.

Detection Methods for CVE-2026-60177

Indicators of Compromise

Unexpected mysqld process termination with signal-based crash entries in the MySQL error log.
Repeated Clone Plugin invocations from a single authenticated session immediately preceding server hang or restart.
MySQL instance unresponsive to new client connections while the process remains active, indicating a hang state.

Detection Strategies

Enable the MySQL general query log or audit log and alert on repeated CLONE INSTANCE FROM statements, particularly from accounts with BACKUP_ADMIN or CLONE_ADMIN privileges.
Correlate mysqld restart events with preceding privileged Clone Plugin activity to identify attempted exploitation.
Monitor for anomalous privilege grants of BACKUP_ADMIN and CLONE_ADMIN that could pre-position an attacker for exploitation.

Monitoring Recommendations

Track MySQL uptime metrics and alert on unplanned restarts or extended query response latency indicative of a hang.
Forward MySQL error logs and audit logs to a centralized log platform for retention and correlation.
Baseline legitimate Clone Plugin usage and treat deviations from known backup or replication windows as suspicious.

How to Mitigate CVE-2026-60177

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all affected MySQL Server and MySQL Cluster instances.
Inventory MySQL deployments to confirm all instances in the affected version ranges are identified and scheduled for patching.
Review and reduce accounts holding BACKUP_ADMIN and CLONE_ADMIN privileges to the minimum required set.

Patch Information

Oracle addressed CVE-2026-60177 in the July 2026 Critical Patch Update. Full advisory and fixed version details are available in the Oracle Critical Patch Update - July 2026. Administrators should upgrade to the fixed releases published in that advisory rather than relying on interim mitigations.

Workarounds

Restrict network access to MySQL listeners so that only trusted application hosts and administrative subnets can reach the server.
Revoke BACKUP_ADMIN and CLONE_ADMIN privileges from accounts that do not require Clone Plugin functionality.
If the Clone Plugin is not in operational use, uninstall it with UNINSTALL PLUGIN clone until patches are applied.

bash

# Remove Clone Plugin privileges and disable the plugin if unused
mysql -u root -p -e "REVOKE BACKUP_ADMIN, CLONE_ADMIN ON *.* FROM 'app_user'@'%';"
mysql -u root -p -e "UNINSTALL PLUGIN clone;"