CVE-2026-61082: MySQL Connector/J Info Disclosure Flaw

CVE-2026-61082 Overview

CVE-2026-61082 is an information disclosure vulnerability in the Oracle MySQL Connectors product, specifically within the Connector/J component. Affected releases include supported versions 9.7.0 through 9.7.1. An unauthenticated attacker with network access can exploit the flaw across multiple protocols. Successful exploitation requires user interaction from a person other than the attacker. A successful attack can result in unauthorized read access to critical data accessible through MySQL Connectors.

Critical Impact
Successful exploitation allows an unauthenticated remote attacker to obtain unauthorized access to critical data handled by MySQL Connector/J when a user is induced to interact with attacker-controlled input.

Affected Products

Oracle MySQL Connectors 9.7.0
Oracle MySQL Connectors 9.7.1
Component: Connector/J

Discovery Timeline

2026-07-21 - CVE-2026-61082 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-61082

Vulnerability Analysis

The vulnerability resides in Oracle MySQL Connector/J, the official Java Database Connectivity (JDBC) driver used by Java applications to communicate with MySQL servers. The flaw allows an unauthenticated remote attacker reachable over multiple protocols to compromise the confidentiality of data accessible to the connector. The CVSS vector indicates a high confidentiality impact with no impact on integrity or availability, aligning with an information disclosure class of weakness. Exploitation requires user interaction, which typically means a user must connect to an attacker-controlled endpoint or process attacker-influenced input through the driver.

Root Cause

Oracle has not published the low-level root cause for CVE-2026-61082. Based on the advisory metadata, the defect resides in the Connector/J code path invoked when a client establishes or processes connections to a remote server. The absence of authentication requirements and the reliance on user interaction suggest the issue is triggered during client-side handling of server-supplied data.

Attack Vector

The attack originates over the network with low complexity and no privileges required. An attacker induces a user or application operator to initiate a connection or action that causes Connector/J to interact with attacker-controlled infrastructure. Once interaction occurs, the attacker can read data that is accessible through the connector context. The vulnerability does not permit modification of data or denial of service.

No verified proof-of-concept code has been published. Refer to the Oracle Critical Patch Update Advisory - July 2026 for authoritative technical guidance.

Detection Methods for CVE-2026-61082

Indicators of Compromise

Java applications loading Connector/J JAR files with versions in the 9.7.0-9.7.1 range, identifiable in build manifests or application classpaths.
Outbound JDBC connections from application servers to unexpected or untrusted MySQL endpoints.
Unusual DNS lookups or TCP connections initiated by JVM processes toward external hosts shortly after users interact with attacker-supplied links, files, or configurations.

Detection Strategies

Inventory all Java applications and build artifacts for mysql-connector-j versions 9.7.0 and 9.7.1 using software composition analysis (SCA) tooling.
Monitor egress from application hosts and developer workstations for JDBC traffic (default TCP 3306) directed to non-approved destinations.
Correlate user-initiated actions (opening configuration files, clicking connection URIs, importing datasource definitions) with subsequent JDBC network activity.

Monitoring Recommendations

Enable JVM network and connection logging to capture the hostnames and IP addresses Connector/J connects to.
Ingest application, proxy, and firewall logs into a centralized analytics platform and alert on JDBC connections to endpoints outside the approved database allowlist.
Track EPSS trend data for CVE-2026-61082 alongside internal exposure metrics to prioritize remediation as exploit likelihood evolves.

How to Mitigate CVE-2026-61082

Immediate Actions Required

Upgrade Oracle MySQL Connector/J to the fixed version specified in the Oracle Critical Patch Update Advisory - July 2026.
Identify every application, container image, and build pipeline that packages mysql-connector-j9.7.0 or 9.7.1 and schedule remediation.
Instruct users and operators not to open MySQL connection URIs, datasource files, or configuration payloads received from untrusted sources.

Patch Information

Oracle addressed CVE-2026-61082 in the July 2026 Critical Patch Update. Consult the Oracle Critical Patch Update Advisory - July 2026 for the exact fixed release of Connector/J and cross-product patch guidance. Apply the update through your standard dependency management workflow (Maven, Gradle, or direct JAR replacement) and rebuild dependent applications.

Workarounds

Restrict outbound network access from hosts running Java applications so Connector/J can reach only approved MySQL servers.
Enforce a strict allowlist of JDBC connection strings and reject user-supplied jdbc:mysql:// URIs at the application layer.
Reduce user interaction pathways by centralizing datasource configuration in server-managed properties rather than user-editable files.

bash

# Example: pin the fixed Connector/J version in a Maven project
# Replace <FIXED_VERSION> with the release listed in the Oracle CPU July 2026 advisory
mvn versions:use-dep-version \
  -Dincludes=com.mysql:mysql-connector-j \
  -DdepVersion=<FIXED_VERSION> \
  -DforceVersion=true