CVE-2026-60191: MySQL Server & Cluster DOS Vulnerability

CVE-2026-60191 Overview

CVE-2026-60191 is a denial of service vulnerability in the Replication component of Oracle MySQL Server and MySQL Cluster. A high-privileged attacker with local logon access to the infrastructure hosting MySQL can trigger a hang or repeatable crash, resulting in complete availability loss. The flaw is mapped to [CWE-284: Improper Access Control] and affects MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, along with MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed the issue in the Oracle Critical Patch Update advisory for July 2026.

Critical Impact
Successful exploitation results in a complete denial of service against MySQL Server or MySQL Cluster through hangs or repeatable crashes of the Replication component.

Affected Products

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 8.0.0 through 8.0.47
Oracle MySQL Cluster versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-60191 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60191

Vulnerability Analysis

The vulnerability resides in the Replication component of MySQL Server and MySQL Cluster. Replication handles the propagation of data changes from a source server to one or more replica servers using binary log events. A weakness in how the replication subsystem enforces access boundaries allows a privileged local user to place the server into an unrecoverable state.

The attack yields no confidentiality or integrity impact. The outcome is limited to availability loss, but that loss is total: the database process either hangs or crashes repeatedly. In clustered deployments, this cascades to replica nodes participating in the same replication topology.

Exploitation requires the attacker to already hold high privileges and possess local logon access to the host running MySQL. This combination narrows the practical attack surface to insider threats, compromised administrative accounts, or lateral movement scenarios where an adversary has already established a privileged foothold.

Root Cause

Oracle categorized the underlying weakness as improper access control [CWE-284] within the Replication component. Oracle has not published implementation-level detail. Consult the Oracle Security Alert July 2026 for vendor-supplied technical context.

Attack Vector

The attack vector is local. An authenticated user with high privileges on the underlying operating system or database instance issues crafted replication operations that drive the server into a hang or crash loop. Remote unauthenticated exploitation is not possible based on the CVSS vector AV:L/AC:H/PR:H.

No verified proof-of-concept code is available. The vulnerability is described in prose only; refer to Oracle's advisory for guidance on affected code paths.

Detection Methods for CVE-2026-60191

Indicators of Compromise

Unexpected crashes or hangs of mysqld processes with restart loops recorded in the MySQL error log
Replication threads stopping abnormally with entries in SHOW REPLICA STATUS indicating IO or SQL thread failure
Sudden growth of core dump files or mysqld.err entries referencing replication event processing

Detection Strategies

Monitor MySQL error logs for repeated crash signatures originating in replication event handlers
Correlate privileged database session activity with subsequent service restarts to identify abuse of high-privileged accounts
Baseline replication lag and thread state; alert on sustained deviations following administrative logins

Monitoring Recommendations

Ingest MySQL audit and error logs into a centralized logging platform for retention and correlation
Track process availability and restart counts for mysqld and ndbd services
Alert on interactive shell logons to database hosts by accounts with elevated privileges

How to Mitigate CVE-2026-60191

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected MySQL Server and MySQL Cluster instances
Inventory MySQL deployments and confirm versions against the affected ranges published by Oracle
Restrict local logon access to database hosts to the minimum set of administrators required for operations

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Details and download references are available in the Oracle Security Alert July 2026. Upgrade MySQL Server to a version later than 8.4.10 or 9.7.1, and MySQL Cluster to a version later than 8.0.47, 8.4.10, or 9.7.1, as applicable.

Workarounds

Reduce the number of accounts holding replication and administrative privileges such as REPLICATION_SLAVE_ADMIN and SUPER
Enforce host-level access controls and jump-host requirements to limit local logon to database servers
Enable the MySQL Enterprise Audit plugin to record privileged replication operations for forensic review

bash

# Configuration example: restrict replication administrative privileges
REVOKE REPLICATION_SLAVE_ADMIN ON *.* FROM 'legacy_admin'@'%';
REVOKE BINLOG_ADMIN ON *.* FROM 'legacy_admin'@'%';
FLUSH PRIVILEGES;

# Verify installed version against the July 2026 CPU baseline
mysql -e "SELECT VERSION();"