CVE-2026-60592: MySQL Cluster DOS Vulnerability

CVE-2026-60592 Overview

CVE-2026-60592 is a network-exploitable vulnerability in the Oracle MySQL Cluster product, specifically within the Cluster: NDB Operator component. Unauthenticated attackers with network access via multiple protocols can compromise MySQL Cluster deployments. Successful exploitation results in a hang or repeatable crash producing complete denial of service. Attackers can also perform unauthorized update, insert, or delete operations against some MySQL Cluster accessible data.

Affected versions include MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle published the vulnerability details in the August 2026 Critical Patch Update advisory. The weakness is categorized under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated network attackers can crash MySQL Cluster instances and tamper with cluster-accessible data without user interaction.

Affected Products

Oracle MySQL Cluster versions 8.0.0 through 8.0.47
Oracle MySQL Cluster versions 8.4.0 through 8.4.10
Oracle MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-08-18 - CVE-2026-60592 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60592

Vulnerability Analysis

The vulnerability resides in the NDB Operator component of MySQL Cluster. The NDB Operator manages MySQL Cluster deployments and coordinates data node and management node operations. Improper access control ([CWE-284]) allows requests to reach cluster operations without proper authorization checks.

The flaw is remotely reachable through multiple protocols exposed by MySQL Cluster services. Attackers require no credentials and no user interaction. Two distinct impacts result from exploitation. First, the attacker can trigger cluster hangs or repeatable crashes producing full denial of service. Second, the attacker can perform unauthorized modification, insertion, or deletion of a subset of cluster-accessible data.

Confidentiality is not directly impacted, but integrity and availability degrade significantly. The vulnerability applies to production deployments running the affected NDB Operator versions in Kubernetes and other orchestrated environments where MySQL Cluster is exposed on internal networks.

Root Cause

The root cause is improper access control within the NDB Operator, mapped to [CWE-284]. The component fails to enforce authorization on operations reachable from the network. Oracle has not released implementation-level details beyond the advisory.

Attack Vector

The attack vector is network-based. An adversary sends crafted requests to a reachable MySQL Cluster endpoint managed by the NDB Operator. No authentication is required, and no user interaction is needed. The attacker executes the operation from a system with network reachability to the cluster management interface. Because MySQL Cluster is commonly deployed on internal networks or within Kubernetes clusters, exposure often depends on internal segmentation.

No verified proof-of-concept code is publicly available. For authoritative technical details, see the Oracle Security Alert.

Detection Methods for CVE-2026-60592

Indicators of Compromise

Unexpected crash or hang events in MySQL Cluster data nodes or management nodes correlated with unauthenticated inbound connections
Unusual INSERT, UPDATE, or DELETE operations against NDB tables originating from unauthenticated sessions or unrecognized source IPs
Repeated connection attempts to the NDB management port (default 1186) from external or unexpected internal sources

Detection Strategies

Enable audit logging on MySQL Cluster and correlate write operations against expected application service accounts
Alert on cluster node restart loops and management node reconnection storms indicative of induced crashes
Baseline normal NDB Operator API traffic and flag deviations in request volume, source, or method

Monitoring Recommendations

Forward MySQL Cluster and NDB Operator logs to a centralized SIEM or data lake for continuous analysis
Monitor Kubernetes audit logs where the NDB Operator is deployed for anomalous API calls against cluster custom resources
Track network flow data to NDB management ports and alert on unauthorized ingress

How to Mitigate CVE-2026-60592

Immediate Actions Required

Inventory all MySQL Cluster deployments and identify instances running affected versions 8.0.0-8.0.47, 8.4.0-8.4.10, or 9.7.0-9.7.1
Apply the patches referenced in the August 2026 Oracle Critical Patch Update advisory as soon as possible
Restrict network access to MySQL Cluster management interfaces to trusted administrative hosts only

Patch Information

Oracle released fixes as part of the August 2026 Critical Patch Update. Refer to the Oracle Security Alert for patched build numbers and upgrade guidance. Upgrade MySQL Cluster to the fixed release aligned with your current major version branch.

Workarounds

Enforce strict network segmentation so only authorized application and administrative hosts can reach NDB management and data node ports
Deploy host-based and network firewalls to block untrusted access to ports 1186 and other NDB service ports
Where the NDB Operator runs in Kubernetes, apply NetworkPolicies restricting ingress to the operator and cluster pods

bash

# Example Kubernetes NetworkPolicy restricting ingress to NDB Operator pods
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ndb-operator-restrict-ingress
  namespace: mysql-cluster
spec:
  podSelector:
    matchLabels:
      app: ndb-operator
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: trusted-apps
      ports:
        - protocol: TCP
          port: 1186