CVE-2026-60331: MySQL Server Privilege Escalation Flaw

CVE-2026-60331 Overview

CVE-2026-60331 affects the replication component of Oracle MySQL Server and Oracle MySQL Cluster. The flaw allows a high-privileged local attacker with logon access to the infrastructure running MySQL to compromise the database service. Successful exploitation results in full takeover of MySQL Server or MySQL Cluster, with impact to confidentiality, integrity, and availability. Oracle rated the issue medium severity in the July 2026 Critical Patch Update.

Critical Impact
A local attacker holding high privileges on the MySQL host can take over MySQL Server or MySQL Cluster through the replication subsystem, resulting in full compromise of database confidentiality, integrity, and availability.

Affected Products

MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
MySQL Cluster versions 8.0.0 through 8.0.47 and 8.4.0 through 8.4.10
MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-60331 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60331

Vulnerability Analysis

The vulnerability resides in the Server: Replication component of MySQL Server and MySQL Cluster. Replication handles the transfer and application of binary log events between primary and replica instances. A defect in this subsystem allows a high-privileged account with local logon to the MySQL host to manipulate replication in a way that compromises the database service.

Oracle classifies the flaw as difficult to exploit. The attack requires local access, high privileges, and no user interaction. Once conditions are met, the attacker can take over MySQL Server or MySQL Cluster with full impact to confidentiality, integrity, and availability.

Root Cause

Oracle has not published the specific defect class or CWE mapping for CVE-2026-60331. The advisory identifies the replication component as the affected code path and confirms the local attack vector requires authenticated access to the infrastructure hosting MySQL. Refer to the Oracle Critical Patch Update Advisory - July 2026 for the full component description.

Attack Vector

The attacker must first obtain high-privileged logon on the server where MySQL Server or MySQL Cluster runs. Network-only access is not sufficient. From that foothold, the attacker interacts with the replication subsystem to escalate control over the database instance. The scope remains unchanged, meaning the impact is confined to the vulnerable MySQL component rather than the underlying operating system.

Because exploitation requires an existing high-privileged local session, this vulnerability is most relevant as a post-compromise escalation path. An attacker who has already breached a database administrator account or a colocated service account can chain this flaw to take over the MySQL instance. No public proof-of-concept or exploit code is available at the time of publication.

Detection Methods for CVE-2026-60331

Indicators of Compromise

Unexpected changes to replication configuration such as new CHANGE REPLICATION SOURCE TO statements or modifications to mysql.slave_master_info and mysql.slave_relay_log_info
Anomalous binary log or relay log activity, including unexplained log rotations, gaps, or events originating from unknown source IDs
Local logons to the MySQL host by administrative accounts outside of scheduled maintenance windows

Detection Strategies

Enable and centrally collect the MySQL general query log, error log, and audit log to capture replication administration commands
Alert on execution of privileged replication statements such as START REPLICA, STOP REPLICA, RESET REPLICA, and CHANGE REPLICATION SOURCE
Correlate operating system authentication events with MySQL privileged sessions to identify unauthorized local access preceding replication changes

Monitoring Recommendations

Baseline replication topology and monitor SHOW REPLICA STATUS output for unexpected source hosts, channels, or GTID sets
Forward MySQL and host telemetry to a centralized data lake for retention and correlation across the database fleet
Track file integrity on MySQL configuration files including my.cnf, replication credential files, and the data directory

How to Mitigate CVE-2026-60331

Immediate Actions Required

Apply the fixes contained in the Oracle Critical Patch Update for July 2026 to all affected MySQL Server and MySQL Cluster instances
Inventory MySQL deployments and identify installations running 8.0.0-8.0.47, 8.4.0-8.4.10, or 9.7.0-9.7.1
Rotate credentials for replication users and database administrator accounts that have local access to MySQL hosts
Restrict interactive logon on database servers to a minimal set of administrators

Patch Information

Oracle addressed CVE-2026-60331 in the July 2026 Critical Patch Update. Upgrade MySQL Server and MySQL Cluster to the patched versions published in the Oracle Security Advisory. Verify installed versions with SELECT VERSION(); and confirm the build matches the advisory guidance.

Workarounds

Limit the REPLICATION SLAVE, REPLICATION CLIENT, and SUPER privileges to a minimal set of service accounts until patches are applied
Enforce operating system access controls that prevent unauthorized local logon to MySQL hosts, including SSH restrictions and multi-factor authentication
Isolate replication traffic on a dedicated network segment and restrict access with host-based firewalls

bash

# Configuration example
# Verify installed MySQL version against the July 2026 CPU
mysql -u admin -p -e "SELECT VERSION();"

# Review replication privileges granted across accounts
mysql -u admin -p -e "SELECT user, host FROM mysql.user WHERE Repl_slave_priv='Y' OR Super_priv='Y';"

# Audit current replication configuration
mysql -u admin -p -e "SHOW REPLICA STATUS\G"