MySQL Router CVE-2026-46860

The MySQL Router HTTP listener (the http_server / REST API surface) must be reachable from the attacker over the network, and the Router must be running an affected 9.0.0-9.7.0 release; no authentication, no user interaction, and no special non-default configuration are required per CVSS PR:N/UI:N/AC:L. Limiting factors in practice: Router HTTP endpoints are commonly bound to management interfaces or localhost in hardened deployments, so exposure depends on whether the HTTP port has been firewalled off from untrusted networks; deployments that have disabled the http_server/rest_api plugins entirely would not present the affected surface.

All available signals point in the same direction: Oracle's CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H gives network reach, low complexity, no privileges, and no user interaction, with full CIA impact - meaning a single HTTP request from anywhere the Router's HTTP port is reachable can fully compromise the Router process. Oracle explicitly labels it 'easily exploitable', which aligns with SSVC 'automatable' criteria even though no SSVC decision is provided in the input. Counter-signals: there is no CISA KEV listing, no EPSS score supplied, and no public POC referenced, so widespread mass exploitation is not yet evidenced. The realistic risk is that this is a near-term high-value target - high CVSS plus trivial exploitation against a database-tier component - even though active exploitation is not yet confirmed; treat it as priority patch rather than waiting for KEV confirmation.

An attacker with network reach to a MySQL Router instance sends a crafted HTTP request to the Router's HTTP listener and, without authenticating, gains control of the Router process - pivoting to intercept, redirect, or manipulate traffic flowing to the backing MySQL InnoDB Cluster. No public exploit is identified at time of analysis, but Oracle's 'easily exploitable' wording and the AV:N/AC:L/PR:N/UI:N vector imply a single-request exploitation pattern that is straightforward to weaponize once technical details surface.