CVE-2026-60179: MySQL Connector/C++ Auth Bypass Flaw

CVE-2026-60179 Overview

CVE-2026-60179 affects the MySQL Connectors product of Oracle MySQL, specifically the Connector/C++ component. The vulnerability impacts supported versions 9.7.0 through 9.7.1. An unauthenticated attacker with network access can exploit this flaw over multiple protocols to compromise MySQL Connectors. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible through MySQL Connectors. The weakness is categorized under [CWE-284] (Improper Access Control). Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can compromise the confidentiality and integrity of data handled by MySQL Connector/C++ deployments running versions 9.7.0–9.7.1.

Affected Products

Oracle MySQL Connectors 9.7.0
Oracle MySQL Connectors 9.7.1
Connector/C++ component of Oracle MySQL

Discovery Timeline

2026-07-21 - CVE-2026-60179 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60179

Vulnerability Analysis

The flaw resides in the Connector/C++ component of Oracle MySQL Connectors. Connector/C++ is the client library that C++ applications use to communicate with MySQL Server. The vulnerability allows an unauthenticated remote attacker to interact with the connector over multiple network protocols. Successful exploitation grants the attacker read access and modification rights over data accessible through the connector.

Exploitation is described by Oracle as difficult, requiring specific conditions beyond a simple network request. Availability is not impacted, but both confidentiality and integrity are affected at a high level. The vulnerability does not require authentication or user interaction.

Root Cause

The underlying weakness maps to [CWE-284] Improper Access Control. Access restrictions within Connector/C++ do not adequately validate operations initiated by unauthenticated network peers. As a result, an attacker can perform data operations that should be restricted to authenticated principals.

Attack Vector

The attack vector is network-based. The attacker communicates with an affected Connector/C++ instance using one of the supported protocols. No credentials are required, and no user interaction is needed on the victim side. Because exploitation is characterized as difficult, an attacker must satisfy conditions outside their direct control, such as specific runtime states or protocol negotiations. No public proof-of-concept is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Oracle has not released technical exploitation details. Refer to the Oracle Security Alert July 2026 for the authoritative advisory.

Detection Methods for CVE-2026-60179

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE statements originating from application hosts using Connector/C++ 9.7.0 or 9.7.1.
Anomalous outbound or inbound MySQL protocol traffic to hosts running affected connector versions.
Application logs showing data modifications without a corresponding authenticated user session.

Detection Strategies

Inventory application hosts and identify software linking against libmysqlcppconn or libmysqlcppconnx at versions 9.7.0 and 9.7.1.
Monitor MySQL Server audit logs for connections and queries that do not correlate with expected application workflows.
Correlate network telemetry with process activity to identify unauthenticated protocol interactions with the connector.

Monitoring Recommendations

Enable the MySQL Enterprise Audit plugin or an equivalent to capture query-level telemetry on connected databases.
Alert on data-modifying statements executed outside of expected application code paths.
Track version drift for Connector/C++ across the fleet and flag hosts still running 9.7.0 or 9.7.1.

How to Mitigate CVE-2026-60179

Immediate Actions Required

Apply the fixes provided in the Oracle Critical Patch Update for July 2026 to every host running Connector/C++ 9.7.0 or 9.7.1.
Restrict network exposure of applications embedding Connector/C++ so they are only reachable from trusted network segments.
Review database audit logs for signs of unauthorized data access or modification during the exposure window.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Consult the Oracle Security Alert July 2026 for the specific patched Connector/C++ release and upgrade instructions. Upgrade all affected client applications and rebuild any statically linked binaries against the fixed version.

Workarounds

Place affected applications behind network access controls that block untrusted sources from reaching connector-exposed protocols.
Enforce least-privilege database accounts so that any successful exploitation has minimal blast radius.
Terminate MySQL sessions on TLS-only endpoints and reject legacy protocol negotiations where feasible.

bash

# Identify hosts with vulnerable Connector/C++ versions on Linux
dpkg -l | grep -Ei 'mysql-connector-c\+\+|libmysqlcppconn' 
rpm -qa | grep -Ei 'mysql-connector-c\+\+|libmysqlcppconn'
ldconfig -p | grep -Ei 'libmysqlcppconn(x)?\.so'