CVE-2026-8276: Bettercap MySQL Server RCE Vulnerability

CVE-2026-8276 Overview

CVE-2026-8276 is an integer coercion vulnerability in bettercap versions up to 2.41.5. The flaw resides in the modules/mysql_server/mysql_server.go file within the MySQL Server module. An attacker can trigger the issue remotely by sending a malformed client handshake to the bettercap MySQL spoofing service. The bug causes an out-of-bounds slice access when the handshake buffer is shorter than expected, leading to a crash of the bettercap process. The vulnerability is tracked under [CWE-189: Numeric Errors] and has been addressed in commit 0eaa375c5e5446bfba94a290eff92967a5deac9e. Exploitation requires high attack complexity and the impact is limited to availability of the bettercap tool itself.

Critical Impact
Remote attackers can crash the bettercap MySQL Server module by sending an undersized client handshake, disrupting active network reconnaissance or man-in-the-middle operations.

Affected Products

bettercap versions up to and including 2.41.5
modules/mysql_server/mysql_server.go component
MySQL Server module within bettercap

Discovery Timeline

2026-05-11 - CVE-2026-8276 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8276

Vulnerability Analysis

The vulnerability exists in the bettercap MySQL Server module, which simulates a MySQL service to capture credentials during network reconnaissance. When a client connects, the module reads a handshake response into readBuffer and immediately indexes into specific byte offsets without validating the number of bytes actually read. If a client sends fewer than 37 bytes, accessing readBuffer[36:] to extract the username triggers an out-of-bounds slice operation. The error stems from improper handling of the read length return value, which the original code discarded by assigning to the blank identifier.

Root Cause

The root cause is an integer coercion and bounds-checking failure [CWE-189]. The function reader.Read(readBuffer) returns the actual byte count, but the original implementation ignored this value. The code then parsed client capabilities at offsets 4 and 5 and extracted the username starting at offset 36. The capabilities computation also used %08b formatting on a 16-bit value, truncating the upper byte and misrepresenting the client capability flags.

Attack Vector

An attacker on the same network as a running bettercap instance with the MySQL Server module enabled can connect to the spoofed MySQL service and transmit a short handshake payload. No authentication is required. The undersized buffer triggers a runtime panic in the Go process, terminating the bettercap session and disrupting ongoing operations.

// Patch from commit 0eaa375c5e5446bfba94a290eff92967a5deac9e
				if _, err := conn.Write(packets.MySQLGreeting); err != nil {
					mod.Warning("error while writing server greeting: %s", err)
					continue
-				} else if _, err = reader.Read(readBuffer); err != nil {
+				} else if read, err = reader.Read(readBuffer); err != nil {
					mod.Warning("error while reading client message: %s", err)
					continue
				}

+				if read < 37 {
+					mod.Warning("client handshake too short (%d bytes)", read)
+					continue
+				}

				// parse client capabilities and validate connection
-				capabilities := fmt.Sprintf("%08b", (int(uint32(readBuffer[4]) | uint32(readBuffer[5])<<8)))
+				capabilities := fmt.Sprintf("%016b", (int(uint32(readBuffer[4]) | uint32(readBuffer[5])<<8)))
				loadData := string(capabilities[8])
				username := string(bytes.Split(readBuffer[36:], []byte{0})[0])

Source: GitHub Commit 0eaa375c. The patch captures the read length, rejects handshakes shorter than 37 bytes, and corrects the capability bit-width formatter from 8 to 16 bits.

Detection Methods for CVE-2026-8276

Indicators of Compromise

Unexpected termination of bettercap processes with Go runtime panic messages referencing slice bounds out of range in mysql_server.go.
Connections to the bettercap MySQL Server listener that close immediately after sending fewer than 37 bytes.
Log entries containing error while reading client message followed by process exit.

Detection Strategies

Monitor stderr and crash logs of bettercap deployments for Go panic traces originating from the mysql_server module.
Inspect network captures of traffic destined to the bettercap MySQL listener for handshake packets below the standard MySQL client handshake length.
Track restart frequency of bettercap services on penetration-testing hosts as a proxy for repeated crashes.

Monitoring Recommendations

Enable verbose logging in bettercap to capture warnings emitted by the patched code path when undersized handshakes arrive.
Forward bettercap operational logs to a central log management system for alerting on repeated module failures.
Review the GitHub issue 1265 for reference signatures of the crash output.

How to Mitigate CVE-2026-8276

Immediate Actions Required

Update bettercap to the version containing commit 0eaa375c5e5446bfba94a290eff92967a5deac9e from the bettercap repository.
Disable the MySQL Server module on bettercap instances that do not require MySQL credential capture.
Restrict network access to hosts running bettercap so only trusted operator subnets can reach the spoofed services.

Patch Information

The fix is delivered through pull request #1266 and merged as commit 0eaa375c5e5446bfba94a290eff92967a5deac9e. The patch validates that the client handshake is at least 37 bytes before parsing username data and corrects the capability flag formatting to a full 16-bit representation. Rebuild bettercap from source at or after this commit, or wait for an upstream release that includes the change.

Workarounds

Run bettercap without the mysql.server module loaded until the patched binary is deployed.
Bind the MySQL Server module to a loopback interface or operator-only VLAN to limit reachability.
Wrap the bettercap process in a supervisor that restarts the tool automatically if it crashes during an engagement.

bash

# Build bettercap from the patched source
git clone https://github.com/bettercap/bettercap.git
cd bettercap
git checkout 0eaa375c5e5446bfba94a290eff92967a5deac9e
make build

# Run without the vulnerable module
./bettercap -eval "set mysql.server.address 127.0.0.1"