CVE-2026-61094: MySQL Server Privilege Escalation Flaw

CVE-2026-61094 Overview

CVE-2026-61094 affects the Replication component of Oracle MySQL Server and MySQL Cluster. The flaw allows a high-privileged attacker with network access via multiple protocols to compromise the database service. Successful exploitation results in full takeover of MySQL Server and MySQL Cluster instances, impacting confidentiality, integrity, and availability.

Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability affects MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, along with MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1.

Critical Impact
Successful exploitation grants full takeover of MySQL Server and MySQL Cluster, exposing all replicated data and enabling arbitrary modification or destruction.

Affected Products

Oracle MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1
Oracle MySQL Cluster versions 8.0.0 through 8.0.47
Oracle MySQL Cluster versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1

Discovery Timeline

2026-07-21 - CVE-2026-61094 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes fix in Oracle Security Alert - July 2026

Technical Details for CVE-2026-61094

Vulnerability Analysis

The vulnerability resides in the Replication component of MySQL Server and MySQL Cluster. This subsystem handles binary log distribution, relay log processing, and coordination between primary and replica nodes. A flaw in how the component processes replication traffic or administrative operations enables an authenticated attacker to escalate control over the database engine.

Oracle rates the issue as easily exploitable once the attacker holds high privileges on the target. The impact spans confidentiality, integrity, and availability, indicating that the flaw permits reading of protected data, modification of stored records, and disruption of database operations. Oracle classifies successful exploitation as a takeover of the affected MySQL Server or MySQL Cluster instance.

At publication, no public proof-of-concept exists. The EPSS probability sits at 0.465%, reflecting current low observed activity.

Root Cause

Oracle has not released detailed root cause information beyond the component identification. The defect exists within replication logic used by both MySQL Server and MySQL Cluster distributions. Because both products share replication code paths, a single flaw affects the full product line.

Attack Vector

Exploitation requires network access to the MySQL service and authenticated credentials with elevated privileges such as REPLICATION SLAVE, REPLICATION CLIENT, or administrative roles. The attacker communicates with the database over supported protocols to trigger the flaw. No user interaction is required. Insider abuse and compromised service accounts represent the primary threat scenarios.

The vulnerability manifests through the replication protocol handling logic. See the Oracle Security Alert - July 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-61094

Indicators of Compromise

Unexpected CHANGE MASTER TO or CHANGE REPLICATION SOURCE TO statements from non-administrative sessions
New replication accounts or privilege grants added outside change control windows
Anomalous binary log or relay log file modifications on primary and replica nodes
MySQL error log entries showing repeated authentication attempts against replication endpoints

Detection Strategies

Enable the MySQL audit plugin and forward authentication and privilege-change events to a centralized log platform
Baseline replication topology and alert on unauthorized additions of replica hosts or replication users
Correlate MySQL access logs with network flow data to identify replication protocol connections from unexpected sources

Monitoring Recommendations

Monitor the performance_schema.replication_connection_status and replication_applier_status tables for unexpected state changes
Track high-privilege account usage including SUPER, REPLICATION_SLAVE_ADMIN, and SYSTEM_VARIABLES_ADMIN
Alert on connections to MySQL ports 3306 and MySQL Cluster management ports from hosts outside the defined replication network

How to Mitigate CVE-2026-61094

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all MySQL Server and MySQL Cluster instances in scope
Inventory database accounts and remove replication or administrative privileges from accounts that do not require them
Restrict network reachability of MySQL and MySQL Cluster management interfaces to trusted management subnets
Rotate credentials for any replication user whose password may have been shared or exposed

Patch Information

Oracle addressed CVE-2026-61094 in the July 2026 Critical Patch Update. Administrators should upgrade to versions released after 8.4.10 for the 8.4 series and after 9.7.1 for the 9.7 series. MySQL Cluster deployments on the 8.0 branch require upgrades beyond 8.0.47. Refer to the Oracle Security Alert - July 2026 for exact fixed version numbers and download links.

Workarounds

Limit accounts holding REPLICATION SLAVE, REPLICATION CLIENT, and SUPER privileges to a small, audited set
Enforce TLS on all replication channels using REQUIRE SSL on replication users to restrict who can connect
Place MySQL Cluster nodes behind network segmentation that permits replication traffic only between authorized peers
Enable and review the MySQL audit log continuously until patching is complete

bash

# Configuration example: restrict replication user and enforce TLS
ALTER USER 'repl'@'10.0.5.%' REQUIRE SSL;
REVOKE SUPER ON *.* FROM 'app_user'@'%';
FLUSH PRIVILEGES;

# Firewall rule to limit MySQL access to replication subnet
iptables -A INPUT -p tcp --dport 3306 -s 10.0.5.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP