CVE-2026-60317: MySQL Connector/Net Auth Bypass Flaw

CVE-2026-60317 Overview

CVE-2026-60317 is a high-severity vulnerability in the Oracle MySQL Connectors product, specifically affecting the Connector/Net component. Supported versions 9.7.0 through 9.7.1 are affected. The flaw allows an unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful exploitation leads to unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all data accessible through the connector. Exploitation is technically difficult but requires no privileges or user interaction.

Critical Impact
Unauthenticated network attackers can gain unauthorized read and write access to all data handled by the MySQL Connector/Net client library.

Affected Products

Oracle MySQL Connectors — Connector/Net 9.7.0
Oracle MySQL Connectors — Connector/Net 9.7.1

Discovery Timeline

2026-07-21 - Oracle publishes Critical Patch Update addressing CVE-2026-60317
2026-07-21 - CVE-2026-60317 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60317

Vulnerability Analysis

The vulnerability resides in Connector/Net, the .NET client library used by applications to communicate with MySQL servers. An unauthenticated remote attacker can leverage network protocols supported by the connector to compromise the client component. Because the flaw impacts the client-side library, exploitation can occur when a vulnerable application connects to an attacker-influenced endpoint or processes attacker-controlled protocol data.

Oracle rates the vulnerability with high confidentiality and integrity impact but no availability impact. The scope remains unchanged, meaning the compromise is confined to the vulnerable connector process and the data it handles. Attack complexity is high, indicating that exploitation depends on conditions beyond the attacker's direct control.

Root Cause

Oracle has not published the underlying weakness class or CWE identifier for this issue. Based on the advisory language, the flaw permits an unauthenticated network peer to manipulate connector behavior in a way that violates data confidentiality and integrity. Refer to the Oracle Security Alert July 2026 for the authoritative advisory.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. The advisory notes that multiple protocols can be used to reach the vulnerable code path. Applications that connect to untrusted MySQL endpoints, accept connection strings from untrusted input, or route connector traffic across untrusted networks face the highest exposure.

No verified proof-of-concept code is publicly available at the time of writing. The EPSS score is 0.257% (17.34 percentile), indicating a low near-term likelihood of observed exploitation.

Detection Methods for CVE-2026-60317

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-60317.
Anomalous outbound connections from applications using Connector/Net to unexpected MySQL endpoints.
Unexpected data modifications in downstream systems that receive input from Connector/Net client applications.

Detection Strategies

Inventory .NET applications and services that bundle MySql.Data or related Connector/Net assemblies at versions 9.7.0 or 9.7.1.
Monitor MySQL protocol traffic for malformed packets or connections to unauthorized database hosts.
Correlate application-layer logs from .NET services with database audit logs to identify unexpected query patterns.

Monitoring Recommendations

Enable MySQL server-side audit logging and alert on schema or row-level changes originating from Connector/Net clients.
Track library version telemetry across the software bill of materials to identify unpatched deployments.
Alert on egress connections from application hosts to database ports on non-approved destinations.

How to Mitigate CVE-2026-60317

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all installations of MySQL Connector/Net running 9.7.0 or 9.7.1.
Identify affected .NET applications through software composition analysis and prioritize those with external network exposure.
Restrict Connector/Net clients to connect only to trusted, authenticated MySQL servers over controlled network paths.

Patch Information

Oracle addressed CVE-2026-60317 in the Oracle Security Alert July 2026. Upgrade Connector/Net to the fixed release published in that Critical Patch Update.

Workarounds

Enforce TLS for all MySQL client connections and validate server certificates to prevent connector interaction with untrusted endpoints.
Segment application networks so that Connector/Net traffic cannot reach arbitrary destinations on the public internet.
Remove or disable unused MySQL protocols and features in the connector configuration where feasible until patching is complete.

bash

# Example: enforce TLS and pin the server in a .NET connection string
# App.config / appsettings.json snippet
Server=db.internal.example.com;Port=3306;Database=app;\
Uid=app_user;Pwd=REDACTED;\
SslMode=VerifyFull;SslCa=/etc/pki/mysql/ca.pem;\
AllowPublicKeyRetrieval=false