MySQL Server CVE-2026-60178

Exploitation requires a network-accessible MySQL Server or Cluster instance running one of the affected versions with the Clone Plugin installed and active (it must be explicitly installed via 'INSTALL PLUGIN clone'). The attacker must hold a high-privileged MySQL account - at minimum one with CLONE_ADMIN or BACKUP_ADMIN privileges - limiting exploitation to authenticated insiders, compromised admin credentials, or attackers who have already achieved partial compromise. The AC:H rating indicates additional non-default or timing-sensitive conditions must be met, the specifics of which are not disclosed in the advisory. Exploitation is NOT possible against MySQL instances where the Clone Plugin is uninstalled, where the attacker lacks high-level credentials, or where network access to the MySQL port is blocked. Standard MySQL deployments that do not use Clone Plugin for replication or data seeding are not operationally exposed to this attack path.

The vendor-assigned CVSS 3.1 score of 6.6 reflects a meaningful tension: while the CIA impact is fully High (C:H/I:H/A:H suggesting complete compromise), the high attack complexity (AC:H) and high privilege requirement (PR:H) substantially reduce exploitability. A high-privileged MySQL account is needed, which in practice means either credentials theft, insider threat, or a secondary vulnerability for privilege escalation. No EPSS score was provided in the input, and the vulnerability carries no CISA KEV designation, indicating no confirmed active exploitation. Tags include 'Information Disclosure,' which is narrower than the 'takeover' language in the description - this inconsistency is unexplained and the more severe takeover outcome should be assumed until Oracle clarifies. SSVC assessment: Exploitation is 'none' (no KEV, no POC); automatable is 'no' (AC:H/PR:H prevent mass exploitation); technical impact is 'total' if successfully triggered. Overall this is a genuine but high-bar-to-exploit vulnerability: high priority for environments using Clone Plugin with externally-accessible MySQL, lower priority in air-gapped or non-Clone deployments.

An attacker who has obtained high-privileged MySQL credentials - whether through credential theft, insider access, or a separate compromise - connects to a vulnerable MySQL Server over the network and triggers a flaw in the Clone Plugin under specific, difficult-to-recreate conditions (AC:H). If successful, the attacker achieves full control of the MySQL Server process, enabling data exfiltration, data manipulation, and service disruption. No public proof-of-concept code has been identified, meaning successful exploitation likely requires significant expertise in MySQL's Clone Plugin internals.