MySQL Server CVE-2026-60311

Exploitation requires a valid low-privileged database account with network access to the MySQL Server or Cluster instance via any supported protocol. The vulnerability is in the Server Optimizer component, meaning the likely trigger is a specially crafted SQL query submitted within a standard authenticated session - no specific non-default configuration, elevated role, or schema ownership is required. What limits exploitation: the attacker must possess or obtain valid database credentials at any privilege level. No unauthenticated access path is indicated by the CVSS vector (PR:L). The flaw is strictly a denial-of-service - it does not enable code execution, privilege escalation, or data exfiltration. Organizations where all database sessions are trusted internal service accounts face lower real-world risk; multi-tenant or shared-database environments where external or less-trusted users hold any database credentials face elevated operational exposure.

The CVSS 3.1 base score of 6.5 (Medium) captures availability-only impact at A:H with no confidentiality or integrity exposure. The attack vector is network with low complexity and low privileges required, meaning any authenticated database account suffices - a condition that substantially lowers the practical barrier to exploitation in shared or multi-tenant deployments. The DoS outcome is described as 'frequently repeatable,' implying an attacker can sustain an outage without persistent access. No EPSS score was included in the available intelligence, limiting probabilistic exploitation assessment. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, suggesting opportunistic risk is currently low. However, organizations running multi-tenant MySQL environments or exposing MySQL to less-trusted application-layer users face meaningfully elevated operational risk given how trivial the privilege bar is. The Medium CVSS score may underrepresent operational impact in high-availability production environments where database uptime is critical.

An attacker with a valid low-privileged MySQL account - such as a shared application credential in a SaaS or hosted database environment - connects over the network and submits a specially crafted SQL query designed to trigger an unhandled condition in the Optimizer component. The MySQL Server process hangs or crashes, immediately denying service to all other connected clients and applications dependent on the database. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests that once a triggering query pattern is identified, exploitation is straightforward and repeatable.