CVE-2026-60725: MySQL Router Auth Bypass Vulnerability

CVE-2026-60725 Overview

CVE-2026-60725 is a high-severity vulnerability in the Oracle MySQL Router product, specifically within the Router: General component. The flaw affects MySQL Router versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1. An unauthenticated attacker with network access over HTTP can compromise MySQL Router, though exploitation requires overcoming significant attack complexity. Successful exploitation grants attackers the ability to create, delete, or modify critical data accessible through MySQL Router, and to read all data the router can access. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can achieve full read and write access to all data reachable through affected MySQL Router instances.

Affected Products

Oracle MySQL Router 8.4.0 through 8.4.10
Oracle MySQL Router 9.7.0 through 9.7.1
Deployments exposing the MySQL Router HTTP interface to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-60725 published to the National Vulnerability Database
2026-07-21 - Oracle published the July 2026 Critical Patch Update advisory
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60725

Vulnerability Analysis

MySQL Router is a lightweight middleware that routes client traffic to backend MySQL servers in InnoDB Cluster and Group Replication deployments. The vulnerable code path resides in the general router component and is reachable through the router's HTTP interface. Because the attack vector is network-based and requires no authentication or user interaction, any network-adjacent attacker who can reach the HTTP listener is in scope.

Exploitation is rated as high complexity, which typically indicates the attacker must win a race condition, satisfy specific runtime conditions, or manipulate state that is not fully under their control. When exploitation succeeds, the attacker gains both confidentiality and integrity impact against data reachable through the router. Availability is not affected, so the router continues functioning while data is exfiltrated or altered.

The EPSS probability of exploitation is 0.318% at the 24th percentile as of 2026-07-23, and no public proof-of-concept has been observed at time of publication.

Root Cause

Oracle has not published detailed root cause information beyond the Critical Patch Update advisory. The classification in the advisory places the flaw within the general router logic exposed over HTTP, and the impact profile is consistent with a broken access control or input validation flaw that allows unauthenticated operations against router-managed data paths.

Attack Vector

The attacker sends crafted HTTP requests to the MySQL Router HTTP interface from any network location that can reach the service. No credentials are required. Once the specific runtime conditions required for exploitation are met, the attacker can issue operations that read or modify any data the router can broker to backend MySQL nodes. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60725

Indicators of Compromise

Unexpected HTTP requests to the MySQL Router management or REST endpoints from external or non-administrative sources
Anomalous data modification patterns on backend MySQL nodes originating from router service accounts
MySQL Router log entries showing unauthenticated access attempts against HTTP handlers
Configuration or metadata cache changes on the router that were not initiated by authorized administrators

Detection Strategies

Baseline normal HTTP traffic to MySQL Router and alert on volume or path deviations
Correlate router HTTP access logs with backend MySQL audit logs to identify router-originated queries that lack a corresponding authenticated client session
Monitor for MySQL Router versions 8.4.0-8.4.10 and 9.7.0-9.7.1 in software inventory feeds

Monitoring Recommendations

Forward MySQL Router logs, HTTP access logs, and backend MySQL audit logs to a centralized analytics platform for correlation
Alert on any external network source reaching the router HTTP port, which typically should be restricted to management networks
Track version and patch state of every MySQL Router deployment against the July 2026 Oracle CPU baseline

How to Mitigate CVE-2026-60725

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all MySQL Router instances running affected versions
Restrict network access to the MySQL Router HTTP interface using firewall rules or host-based access controls
Audit router HTTP logs for the preceding 30 days to identify suspicious unauthenticated requests
Rotate credentials for backend MySQL accounts accessible through affected routers

Patch Information

Oracle addressed CVE-2026-60725 in the July 2026 Critical Patch Update. Administrators should upgrade MySQL Router to a fixed release beyond 8.4.10 on the 8.4 branch or beyond 9.7.1 on the 9.7 branch. Refer to the Oracle Security Alert July 2026 for exact fixed version numbers and download locations.

Workarounds

Bind the MySQL Router HTTP interface to localhost or a dedicated management interface unreachable from application networks
Place the router behind a reverse proxy or network access control list that enforces authenticated access to HTTP endpoints
Disable the HTTP interface entirely if it is not required for the deployment by removing the corresponding [http_server] section from mysqlrouter.conf

bash

# Example: disable HTTP server section in mysqlrouter.conf
# Comment out or remove the following block, then restart the router
# [http_server]
# port=8443
# ssl=1
sudo systemctl restart mysqlrouter