CVE-2026-60189: MySQL Server DOS Vulnerability

CVE-2026-60189 Overview

CVE-2026-60189 is a denial of service vulnerability in the Replication component of Oracle MySQL Server and MySQL Cluster. Oracle disclosed the flaw in the July 2026 Critical Patch Update. A high-privileged attacker with network access can hang or repeatedly crash affected MySQL instances, resulting in a complete availability loss. The issue is classified under [CWE-284] Improper Access Control and impacts availability only, with no direct effect on confidentiality or integrity.

Critical Impact
Successful exploitation causes a complete denial of service of MySQL Server and MySQL Cluster instances handling replication traffic.

Affected Products

MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
MySQL Cluster versions 8.0.0 through 8.0.47 and 8.4.0 through 8.4.10
MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-60189 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60189

Vulnerability Analysis

The vulnerability resides in the Replication subsystem of MySQL Server and MySQL Cluster. An authenticated attacker holding high privileges on the database can send crafted replication traffic across multiple supported protocols. Processing this traffic drives the server into a hang state or triggers a repeatable crash. The condition affects availability exclusively, with confidentiality and integrity remaining intact. Oracle rates exploitation complexity as high, which reflects the specific replication state and privilege prerequisites required to reach the vulnerable code path.

Root Cause

Oracle attributes the flaw to Improper Access Control [CWE-284] within the Server: Replication component. The replication code path fails to correctly validate or constrain operations that a privileged replication client can invoke. When an attacker leverages this gap, MySQL enters an unrecoverable state and terminates or stalls the service.

Attack Vector

The attacker must have network access to the MySQL instance and authenticated privileges sufficient to interact with the replication subsystem. Oracle notes that the attack may traverse multiple protocols supported by the server. No user interaction is required, and the scope remains unchanged. Because privileged access is required, the primary threat model involves compromised replication accounts, malicious insiders, or lateral movement from an already breached database node.

Refer to the Oracle Security Alert July 2026 for the authoritative technical description.

Detection Methods for CVE-2026-60189

Indicators of Compromise

Unexpected mysqld process crashes or restarts on replication source or replica nodes
Repeated replication IO or SQL thread failures logged in error.log immediately preceding a service hang
Abnormal replication traffic patterns from accounts with REPLICATION SLAVE or equivalent privileges
Sudden loss of quorum or node dropouts in MySQL Cluster environments

Detection Strategies

Monitor MySQL error logs for crash signatures, assertion failures, and unexpected shutdown messages tied to the replication threads
Correlate replication account authentication events with subsequent instability of the target instance
Baseline replication protocol traffic volumes and alert on anomalous bursts from replica peers

Monitoring Recommendations

Enable audit logging on all accounts with replication-related privileges and forward events to a centralized SIEM
Track uptime and crash counters for mysqld and MySQL Cluster data nodes as availability KPIs
Alert on SHOW REPLICA STATUS errors, stalled replication lag, and repeated coordinator failovers

How to Mitigate CVE-2026-60189

Immediate Actions Required

Apply the fixes distributed in the Oracle July 2026 Critical Patch Update to all affected MySQL Server and MySQL Cluster instances
Inventory database accounts with replication privileges and remove entitlements that are not strictly required
Restrict network reachability of MySQL replication ports to known, trusted replica peers only

Patch Information

Oracle addressed the vulnerability in the Oracle Security Alert July 2026. Administrators should upgrade MySQL Server past 8.4.10 and 9.7.1, and MySQL Cluster past 8.0.47, 8.4.10, and 9.7.1 in accordance with Oracle's release guidance.

Workarounds

Rotate credentials for replication accounts and enforce strong authentication controls until patching completes
Segment replication traffic onto dedicated management networks and enforce firewall rules limiting access to authorized replicas
Enable TLS for replication channels to reduce exposure to unauthorized clients attempting to reach the replication protocol

bash

# Example: restrict replication account host scope and rotate credentials
mysql -u admin -p -e "ALTER USER 'repl'@'10.0.0.0/24' IDENTIFIED BY 'STRONG_PASSWORD';"
mysql -u admin -p -e "REVOKE ALL PRIVILEGES ON *.* FROM 'repl'@'%';"
mysql -u admin -p -e "GRANT REPLICATION SLAVE ON *.* TO 'repl'@'10.0.0.0/24' REQUIRE SSL;"
mysql -u admin -p -e "FLUSH PRIVILEGES;"