MySQL Server CVE-2026-21998

Exploitation requires that the attacker hold a high-privilege MySQL account - DBA, SUPER, or equivalent - as confirmed by the CVSS vector's PR:H metric; standard low-privilege application accounts are insufficient. The attack is conducted remotely over the network (AV:N) and can use multiple MySQL protocols including the native protocol (port 3306) and X Protocol (port 33060), with no user interaction required (UI:N). Exploitation is constrained by: the mandatory high-privilege credential prerequisite, which limits the realistic attacker pool to insiders or post-compromise lateral movement; SSVC automatable=no, indicating the attack cannot be trivially mass-scripted; and the absence of any known public exploit. Environments that restrict high-privilege MySQL account access to specific trusted internal hosts and enforce credential least-privilege meaningfully reduce the practical attack surface beyond what the raw CVSS score reflects.

The CVSS 3.1 base score of 4.9 (Medium) is appropriate and primarily shaped by PR:H - the attacker must already hold a high-privilege MySQL account (e.g., DBA or SUPER user) to trigger the flaw. This single constraint dramatically narrows the realistic attacker population to insiders, compromised application service accounts with over-provisioned privileges, or post-breach lateral movement scenarios. EPSS at 0.04% (11th percentile) corroborates a very low probability of observed in-the-wild exploitation. CISA SSVC confirms exploitation status as 'none,' automatable as 'no' (consistent with the authentication barrier), and technical impact as 'partial.' No KEV listing and no public POC further reduce urgency. The primary risk scenario is an insider threat or an attacker who has already compromised high-privilege credentials. The broad version coverage across three LTS branches increases the organizational patch surface but does not elevate exploitation likelihood. Organizations with properly segmented MySQL access - where DBA credentials are tightly controlled and MySQL ports are firewalled - face minimal immediate operational risk.

An insider or an attacker who has obtained high-privilege MySQL credentials (DBA-level or SUPER access) connects to the MySQL server over the network using the native protocol or X Protocol and submits a specially crafted SQL query designed to trigger uncontrolled resource consumption in the Optimizer component. The server processes the malformed query plan without adequate resource bounds, exhausting CPU or memory and causing the MySQL process to hang or crash, denying service to all connected clients and applications. No public exploit code is known at time of analysis, and the PR:H requirement makes opportunistic mass exploitation impractical.