MySQL Server CVE-2026-60182

Exploitation requires all three of the following conditions to be met: (1) Network access to the target MySQL Server or MySQL Cluster instance via any supported protocol (TCP/IP is the most common); (2) a high-privileged database account - the CVSS PR:H metric explicitly confirms that SUPER, BACKUP_ADMIN, or equivalent MySQL administrative privileges are required, ruling out exploitation by low-privileged or unauthenticated users; and (3) high attack complexity (AC:H), indicating a non-trivial triggering requirement such as a specific server state, race condition, or precisely constructed Clone Plugin interaction. Exploitation is further limited by the fact that the Clone Plugin must be active and accessible, and that the attacker must possess detailed knowledge of the specific failure condition. The primary realistic threat actors are malicious insiders with DBA access, compromised privileged service accounts, or attackers who have already achieved significant lateral movement within the database environment.

The CVSS 3.1 base score of 4.4 (Medium) accurately reflects a constrained threat profile. The two most limiting factors - High attack complexity (AC:H) and High privileges required (PR:H) - mean exploitation is not opportunistic: an attacker must already control a DBA-level or SUPER-privileged database account and must craft a specific triggering request, implying knowledge of an internal error condition. The availability impact is High (A:H), so a successful attack fully disrupts the database instance, which is operationally severe for availability-sensitive deployments. However, scope is unchanged (S:U), and there is no confidentiality or integrity impact. No EPSS score is available in the provided data. This CVE does not appear in the CISA KEV catalog, and no public proof-of-concept has been identified - real-world exploitation risk is therefore low-to-moderate and confined primarily to insider threats, compromised privileged accounts, or attackers who have already achieved significant access to the database tier. MySQL Cluster has a broader affected range (from 8.0.0) than MySQL Server, expanding the version exposure window for Cluster deployments.

A database administrator account - or a service account that has been compromised and holds SUPER or BACKUP_ADMIN privileges - connects to the MySQL Server or Cluster instance over the network and issues a specially crafted request targeting the Clone Plugin. The server encounters an unhandled internal condition of high complexity, resulting in the database process hanging indefinitely or crashing repeatedly, rendering the instance unavailable. No public proof-of-concept exploit code has been identified, and the AC:H requirement implies the attacker needs specific knowledge of the triggering condition rather than a trivially repeatable input.