MySQL Router CVE-2026-101633

Exploitation requires an authenticated low-privileged account (CVSS PR:L) with network access to the MySQL Router over HTTPS, affecting MySQL Router version 26.7.0 specifically. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the mandatory pre-existing low-privilege credential is the key limiting factor that prevents anonymous remote exploitation. Impact is confined to unauthorized read access to a subset of MySQL Router-accessible data (C:L), with no write/integrity or availability effect, so the realistic risk is limited information disclosure rather than full compromise.

This is a low-to-moderate severity issue that does not represent an urgent priority. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning network-reachable over HTTPS and low attack complexity, but it requires an authenticated low-privileged account (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public proof-of-concept was identified, so there is no evidence of active exploitation or weaponization. Notably, the 'Authentication Bypass' tag CONFLICTS with the CVSS vector and description: PR:L and 'low privileged attacker' indicate the attacker must already be authenticated and the impact is read access to a subset of data - not an authentication bypass. Treat that tag as likely mislabeled rather than as evidence of a credential-bypass flaw. Overall this is a genuine but bounded information-disclosure bug; patch in normal Oracle Critical Patch Update cycles rather than as an emergency.

An attacker who already holds a low-privileged account with network access to the MySQL Router management/HTTPS interface sends crafted requests that cause the Router to disclose a subset of accessible data it should not expose. Low attack complexity means the request is reliable once access and credentials are held, but no public exploit code is known and impact is limited to confidentiality of a data subset. No privilege escalation, data modification, or service disruption results.