MySQL Cluster CVE-2026-60171

Exploitation requires a high-privileged database account (e.g., DBA or SUPER-privilege holder) authenticated to the MySQL Cluster instance - this is confirmed by the CVSS vector PR:H. The attacker must have network reachability to the MySQL Cluster endpoint via any supported protocol (MySQL protocol, NDB API, or management API). No user interaction is required (UI:N). Factors that limit exploitation: the PR:H requirement means an attacker must first obtain elevated database credentials through a separate compromise step (e.g., credential theft, phishing, or insider threat) before this vulnerability is reachable; impact is restricted to availability only, with no confidentiality or integrity exposure; and no public exploit code exists to lower the bar for unskilled attackers. Non-default or special configuration is not identified as a prerequisite - any MySQL Cluster 8.0.0-8.0.47 deployment with reachable network access and a compromised high-privilege account is potentially vulnerable.

The vendor-assigned CVSS 3.1 score of 4.9 (Medium) accurately reflects the constrained real-world risk profile. The network attack vector (AV:N) with low complexity (AC:L) indicates that exploitation is technically straightforward once the attacker has access, but the high privilege requirement (PR:H) is the dominant limiting factor - an attacker must already hold DBA-level or equivalent credentials before any exploitation is possible. Impact is exclusively availability (A:H), with no confidentiality or integrity compromise, limiting the worst case to a disruptive but recoverable denial-of-service scenario. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, no POC is available, and the reporter is the vendor itself (Oracle CPU disclosure), suggesting this is a proactive patch rather than a response to observed exploitation. The realistic threat model is limited to insider threat or credential-compromise scenarios where an adversary already controls high-privilege database accounts.

An attacker who has compromised or legitimately holds a high-privileged MySQL Cluster account connects via the network and submits a specially crafted SQL query targeting the Optimizer component, triggering a hang or crash of the cluster node. Because no public POC is available, the specific trigger query is not publicly known, limiting exploitation to those with independent discovery capability or insider access. If clustering is used for high-availability workloads, repeated crashes could result in sustained service outages affecting dependent applications.