CVE-2026-61081: MySQL Server Information Disclosure Flaw

CVE-2026-61081 Overview

CVE-2026-61081 is an information disclosure vulnerability in the Oracle MySQL Server and MySQL Cluster products, specifically within the Server: Performance Schema component. A high-privileged attacker with network access via multiple protocols can exploit this flaw to gain unauthorized read access to a subset of MySQL Server and MySQL Cluster data. The vulnerability is easily exploitable but requires existing elevated privileges on the target system.

Critical Impact
Successful exploitation results in unauthorized read access to a subset of MySQL Server and MySQL Cluster accessible data, affecting confidentiality without impact to integrity or availability.

Affected Products

MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
MySQL Cluster versions 8.0.0 through 8.0.47 and 8.4.0 through 8.4.10
MySQL Cluster versions 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-61081 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Critical Patch Update advisory

Technical Details for CVE-2026-61081

Vulnerability Analysis

The vulnerability resides in the Performance Schema component of MySQL Server and MySQL Cluster. Performance Schema is a feature that monitors MySQL Server execution at a low level, exposing runtime statistics through internal tables. The flaw allows a high-privileged user with network access to read data that should be restricted, producing an unauthorized information disclosure condition.

The issue is categorized as an Information Disclosure vulnerability. It does not permit modification of data, code execution, or denial of service. According to the EPSS scoring model, the probability of exploitation activity in the wild is low.

Root Cause

The root cause lies in insufficient access control within the Performance Schema instrumentation of MySQL Server and MySQL Cluster. The affected component exposes internal server data to authenticated sessions holding elevated privileges without applying appropriate boundary checks on the returned dataset. This design gap allows a subset of otherwise restricted server data to be observed.

Attack Vector

Exploitation requires network reachability to the MySQL Server or MySQL Cluster instance and valid credentials with high privileges. The attacker interacts with the server across multiple supported protocols, then issues queries or operations against Performance Schema resources. No user interaction is required, and attack complexity is low. Because the attacker must already hold high privileges, the vulnerability primarily represents a lateral information exposure risk from compromised or misused administrative accounts.

No public proof-of-concept code is available for CVE-2026-61081. Refer to the Oracle Security Alert CPU July 2026 for authoritative technical details.

Detection Methods for CVE-2026-61081

Indicators of Compromise

Unexpected queries against performance_schema tables originating from administrative accounts outside routine maintenance windows.
Repeated authentication events from high-privileged MySQL users followed by bulk reads from Performance Schema views.
Network sessions to MySQL listeners from hosts that do not normally initiate database administration traffic.

Detection Strategies

Enable the MySQL general query log or audit plugin and alert on SELECT statements targeting performance_schema.* from privileged accounts.
Baseline expected Performance Schema query patterns and flag deviations in query volume, tables accessed, or session duration.
Correlate database access logs with identity telemetry to identify use of high-privileged MySQL accounts from unusual endpoints.

Monitoring Recommendations

Forward MySQL audit logs to a centralized analytics platform for retention and query.
Monitor for privilege changes, particularly GRANT statements that assign roles capable of reaching Performance Schema.
Track failed and successful logins for accounts with PROCESS, SUPER, or equivalent privileges on affected versions.

How to Mitigate CVE-2026-61081

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all affected MySQL Server and MySQL Cluster instances.
Inventory MySQL deployments and identify instances running affected versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1.
Review and reduce the number of accounts holding high privileges on production databases.

Patch Information

Oracle addressed CVE-2026-61081 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert CPU July 2026 for the specific fixed versions and download locations. Upgrade MySQL Server to a version later than 9.7.1 or 8.4.10 as specified in the Oracle advisory, and update MySQL Cluster beyond 8.0.47, 8.4.10, and 9.7.1.

Workarounds

Restrict network access to MySQL listeners using firewall rules and allowlist only known administrative hosts.
Revoke unnecessary high-privilege grants and enforce role separation between application and administrative accounts.
Enable MySQL audit logging to record and review Performance Schema access until patches are deployed.

bash

# Configuration example: restrict Performance Schema access and enable audit logging
# Revoke broad privileges from application accounts
REVOKE PROCESS, SUPER ON *.* FROM 'app_user'@'%';

# Enable the audit log plugin (Enterprise) or general log for temporary monitoring
SET GLOBAL general_log = 'ON';
SET GLOBAL general_log_file = '/var/log/mysql/general.log';

# Firewall example (iptables): allow MySQL only from admin subnet
iptables -A INPUT -p tcp --dport 3306 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP