MySQL Server CVE-2026-60191

Exploitation requires all of the following conditions to be met simultaneously: (1) the attacker must have local logon access (AV:L) to the physical or virtual infrastructure on which MySQL Server or MySQL Cluster is executing - remote network exploitation is not possible; (2) the attacker must hold a high-privileged account (PR:H), such as a MySQL user with SUPER privilege, REPLICATION SLAVE privilege, or equivalent OS-level access; and (3) difficult-to-reproduce technical conditions within the Replication component must be satisfied (AC:H), meaning the attack cannot be reliably triggered without specific knowledge of the internal state or race conditions. The scope is unscoped (S:U), so exploitation does not pivot to other components or systems. There is no user interaction required (UI:N). Limiting factors include the strict local-only access requirement, the high privilege bar, and the high attack complexity - collectively making this unsuitable for automated or mass exploitation. Impact is strictly limited to availability; no data theft or tampering is possible via this vulnerability.

Despite MySQL's widespread deployment, the real-world risk of this specific vulnerability is low. The CVSS 3.1 base score of 4.1 accurately reflects the constrained exploitation profile: AV:L requires the attacker to already have local logon access to the host running MySQL; PR:H requires a high-privileged database or OS account; and AC:H indicates the attack requires difficult-to-reproduce conditions, meaning reliable exploitation is not trivial even for a determined insider. The impact is limited exclusively to availability (A:H) - there is no confidentiality or integrity exposure (C:N, I:N). No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA's KEV catalog and no public exploit or POC has been identified. In practice, this vulnerability is most relevant to threat models involving malicious insiders, compromised privileged service accounts, or attacker persistence scenarios where the adversary has already escalated to high privilege on the database host. It does not represent an opportunistic, internet-facing risk.

A database administrator or a threat actor who has already compromised a high-privileged MySQL account and has local access to the MySQL host crafts or triggers a specific sequence of replication operations that expose the flaw in the Replication component, causing the MySQL Server or Cluster process to hang or crash. Because AC:H applies, reliably reproducing the crash requires knowledge of or access to a particular internal state, making this more likely a targeted insider action than opportunistic exploitation. No public exploit code exists at time of analysis.