MySQL Router CVE-2026-101631

Requires a reachable MySQL Router 26.7.0 instance exposing its HTTPS interface, PLUS successful human interaction from a person other than the attacker (UI:R) - e.g. an operator or user must be induced to act on an attacker-crafted HTTPS request/resource. Oracle rates it high-complexity ('Difficult to exploit', AC:H), implying additional conditions beyond the attacker's control (timing, specific state, or victim configuration) must align. LIMITING FACTORS: no authentication is needed (PR:N) which raises exposure, but the mandatory victim interaction and high complexity sharply reduce realistic exploitability; only the single supported version 26.7.0 is listed as affected, and there is no availability impact (A:N).

This is a genuine but medium-priority issue rather than a top-tier emergency. The CVSS 3.1 score is 6.8 (MEDIUM), and the vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) tells a nuanced story: although the attack is network-reachable over HTTPS and requires no authentication (PR:N), it is explicitly rated high attack complexity (AC:H, Oracle's description says 'Difficult to exploit') AND requires human interaction from a victim other than the attacker (UI:R). These two factors substantially depress real-world exploitability. Impact is meaningful where it lands - high confidentiality and high integrity (C:H/I:H) over all MySQL Router accessible data - but there is no availability impact (A:N) and scope is unchanged (S:U). No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no signal of active or imminent mass exploitation; mapping to SSVC, exploitation=none, automatable=no (UI:R precludes automated/worm-like spread), and technical impact is partial-to-total for C/I only. CONFLICTING SIGNAL TO VERIFY: the input Tags include 'Authentication Bypass', but Oracle's description does not describe any authentication-bypass mechanism - it describes an unauthenticated, interaction-dependent data-compromise flaw; treat that tag as unverified. Overall: patch on a normal cycle, not a drop-everything fire.

An attacker hosts or injects a malicious HTTPS resource/request and socially engineers a legitimate MySQL Router operator or user into interacting with it (the required UI:R, person-other-than-attacker condition). When the victim acts, the crafted interaction triggers the flaw in the Router: General component, letting the unauthenticated attacker read and modify data accessible to MySQL Router. No public exploit identified at time of analysis, and the high attack complexity means a reliable exploit is non-trivial to build.