CVE-2026-60569: MySQL Cluster Information Disclosure Flaw

CVE-2026-60569 Overview

CVE-2026-60569 is an information disclosure vulnerability in the Oracle MySQL Cluster product, specifically within the Cluster: NDB Operator component. The flaw affects MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. An unauthenticated attacker with local logon access to the infrastructure hosting MySQL Cluster can exploit this weakness. Successful exploitation grants unauthorized access to critical MySQL Cluster data, up to complete read access of all Cluster-accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
A successful attack can result in complete read access to all data stored and processed by the affected MySQL Cluster instance, breaching confidentiality of database contents.

Affected Products

Oracle MySQL Cluster versions 8.0.0 through 8.0.47
Oracle MySQL Cluster versions 8.4.0 through 8.4.10
Oracle MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-60569 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60569

Vulnerability Analysis

The defect resides in the NDB Operator component of MySQL Cluster, which manages Network Database (NDB) engine operations for the clustered storage layer. The vulnerability is classified as an information disclosure issue with impact limited to confidentiality. Integrity and availability are not affected, meaning the flaw enables data reading rather than modification or service disruption.

Oracle rates exploitation as difficult, requiring specific conditions in the target environment. However, no authentication is required once the attacker reaches the infrastructure. The EPSS model estimates a low probability of exploitation activity at 0.131%, placing this CVE in the 3rd percentile of scored vulnerabilities.

Root Cause

Oracle has not published the underlying code-level defect. Based on the component location and impact profile, the flaw exists in how the NDB Operator handles internal cluster data structures or interprocess communication, permitting an attacker with a local foothold to read data that should remain isolated to the Cluster runtime.

Attack Vector

Exploitation requires local access to the host running MySQL Cluster. The attacker does not need valid database credentials or MySQL user accounts. Once logged into the underlying operating system with any local account, the adversary can interact with NDB Operator interfaces to extract Cluster-managed data. This positions the vulnerability as a post-initial-access risk, typically chained after a separate compromise of a Cluster node.

No proof-of-concept exploit is publicly available at the time of publication, and CISA has not added CVE-2026-60569 to the Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60569

Indicators of Compromise

Unexpected local user sessions on MySQL Cluster nodes, particularly from service accounts that should not initiate interactive logins
Unusual process execution invoking NDB Operator binaries or interacting with cluster socket files outside of routine administrative windows
Anomalous read patterns against NDB data files or shared memory segments used by the Cluster runtime

Detection Strategies

Correlate local logon events on Cluster hosts with subsequent process activity targeting ndb_* binaries or NDB Operator API endpoints
Baseline normal administrative behavior on database infrastructure and alert on deviations, including new parent-child process chains that access NDB resources
Review Oracle MySQL Cluster audit logs for out-of-band queries or operator commands that do not correspond to change tickets

Monitoring Recommendations

Enable and forward operating system authentication logs from all Cluster nodes to a centralized analytics platform
Monitor file access telemetry on NDB data directories and configuration paths for read events from non-service identities
Track privileged shell activity on database hosts and require justification for interactive sessions on production Cluster members

How to Mitigate CVE-2026-60569

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all MySQL Cluster deployments running affected versions
Inventory MySQL Cluster instances and confirm version numbers against the affected ranges 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1
Restrict local logon rights on Cluster hosts to a minimal set of administrators and remove standing shell access for non-DBA personnel
Rotate credentials and audit privileged accounts on database infrastructure to reduce the blast radius of any prior local compromise

Patch Information

Oracle addressed CVE-2026-60569 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Advisory - July 2026 for exact patched versions, download locations, and upgrade guidance for MySQL Cluster 8.0.x, 8.4.x, and 9.7.x branches. Test patches in a staging cluster before rolling to production to validate NDB Operator behavior.

Workarounds

Enforce strict host-level access controls so that only trusted operators can obtain local sessions on Cluster nodes
Isolate MySQL Cluster networks and hosts using network segmentation and host firewalls to limit lateral movement paths that could yield local access
Disable interactive login for the MySQL service account and require jump-host access with session recording for administrative work

bash

# Configuration example: verify installed MySQL Cluster version against affected ranges
mysql --version
ndb_mgm -e "show"

# Restrict local logon on Linux Cluster nodes (example using PAM access.conf)
# Deny interactive logon to all users except explicit DBA group members
echo "-:ALL EXCEPT dba root:ALL" | sudo tee -a /etc/security/access.conf