CVE-2026-70724: MySQL Cluster RCE Vulnerability

CVE-2026-70724 Overview

CVE-2026-70724 is a high-severity vulnerability in the Oracle MySQL Cluster product, specifically within the Cluster: General component. Affected releases include MySQL Cluster versions 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. An unauthenticated remote attacker can compromise MySQL Cluster over HTTP, but exploitation requires user interaction from someone other than the attacker. Successful exploitation results in full takeover of MySQL Cluster with impacts to confidentiality, integrity, and availability. Oracle disclosed the flaw in its August 2026 Critical Patch Update.

Critical Impact
Successful exploitation permits full takeover of a MySQL Cluster deployment, exposing stored data and cluster operations to a remote attacker.

Affected Products

Oracle MySQL Cluster 8.0.0 through 8.0.48
Oracle MySQL Cluster 8.4.0 through 8.4.11
Oracle MySQL Cluster 9.7.0 through 9.7.2

Discovery Timeline

2026-08-18 - CVE-2026-70724 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70724

Vulnerability Analysis

The vulnerability resides in the general cluster handling code of Oracle MySQL Cluster and is reachable over the network via HTTP. An unauthenticated attacker can trigger the flaw, but the attack chain depends on a separate user performing an action that the attacker cannot induce automatically. Successful exploitation results in a complete compromise of the MySQL Cluster instance, affecting the confidentiality of stored data, the integrity of cluster records, and the availability of database services.

Because the attack traverses HTTP rather than the native MySQL protocol, exposed management or administrative HTTP surfaces of MySQL Cluster are the primary attack path. Oracle categorizes exploitation complexity as high, meaning the attacker must satisfy conditions outside their direct control, including the required user interaction.

Root Cause

Oracle has not published detailed technical root-cause information for CVE-2026-70724. The advisory describes the issue as a flaw in the Cluster: General component reachable through HTTP that permits takeover when combined with user interaction. Refer to the Oracle Security Alert for the vendor's authoritative description.

Attack Vector

The attack originates from the network and uses HTTP as the transport. No authentication is required from the attacker. A separate, legitimate user must perform an interaction that completes the exploitation chain, which typically implies a social-engineering or user-triggered request against a MySQL Cluster HTTP interface. When conditions align, the attacker gains control of the cluster process.

No verified proof-of-concept code is publicly available for this vulnerability. Refer to the Oracle advisory for the authoritative technical description.

Detection Methods for CVE-2026-70724

Indicators of Compromise

Unexpected HTTP requests to MySQL Cluster management interfaces from external or unrecognized sources.
New or modified administrative accounts, roles, or configuration files on MySQL Cluster nodes.
Anomalous child processes spawned by MySQL Cluster service binaries.
Unexplained restarts, crashes, or configuration reloads of ndbd, ndb_mgmd, or related cluster processes.

Detection Strategies

Inspect web proxy and reverse-proxy logs for HTTP traffic destined to MySQL Cluster hosts, particularly from untrusted networks.
Correlate authentication events and cluster configuration changes against a known baseline to surface unauthorized modifications.
Alert on outbound connections initiated by MySQL Cluster service accounts, which should rarely originate arbitrary network traffic.

Monitoring Recommendations

Enable verbose audit logging on MySQL Cluster management nodes and forward logs to a central SIEM.
Monitor process-integrity of cluster binaries and configuration files for unexpected modification.
Track HTTP request patterns against the affected versions listed in the Oracle advisory and flag versions that have not been patched.

How to Mitigate CVE-2026-70724

Immediate Actions Required

Apply the Oracle August 2026 Critical Patch Update to MySQL Cluster hosts running 8.0.0-8.0.48, 8.4.0-8.4.11, or 9.7.0-9.7.2.
Restrict network access to MySQL Cluster HTTP interfaces so only trusted administrative networks can reach them.
Audit MySQL Cluster nodes for signs of unauthorized configuration changes or new accounts before patching.

Patch Information

Oracle addressed CVE-2026-70724 in the August 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for exact patched version numbers and upgrade guidance for each affected release train.

Workarounds

Place MySQL Cluster HTTP endpoints behind a reverse proxy or firewall that enforces source IP allowlisting.
Disable or block any non-essential HTTP-facing services on MySQL Cluster nodes until patches are deployed.
Educate administrators and operators about the user-interaction requirement, discouraging clicks on untrusted links or requests targeting cluster management URLs.

bash

# Example iptables rule to restrict HTTP access to MySQL Cluster hosts
# Replace 10.0.0.0/24 with the trusted administrative network
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP