MySQL Cluster CVE-2026-60569

The attacker must have operating-system-level logon access to the specific host where MySQL Cluster and its NDB Operator execute - remote network exploitation is explicitly ruled out by AV:L. High attack complexity (AC:H) further requires that specific conditions beyond the attacker's direct control must be present or engineered; the exact nature of these conditions is not specified in available data. The vulnerable component is the NDB Operator specifically, so MySQL Cluster must be deployed with the NDB Operator active (typical in Kubernetes-based deployments). Exploitation is limited to confidentiality - no integrity modification or availability disruption results. The description does not specify whether a particular NDB Operator configuration setting or operational mode must be enabled; this detail is unconfirmed in current intelligence. No user interaction is required once host access and exploitation conditions are met.

The vendor-assigned CVSS 3.1 score of 5.1 (Medium) reflects two primary dampeners: local attack vector (AV:L, meaning network exploitation is not possible) and high attack complexity (AC:H, meaning difficult, condition-dependent exploitation). No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified independently. This vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no publicly available exploit code has been identified. Despite the moderate score, the Authentication Bypass tag combined with a C:H impact rating - complete read access to all MySQL Cluster accessible data - elevates real-world concern for multi-tenant or shared infrastructure deployments where host-level access boundaries are less strict. For tightly controlled, single-tenant deployments with restricted host access, the realistic risk is low. The absence of a CWE and the lack of technical advisory detail beyond the NVD description introduce uncertainty around exploitability specifics.

An attacker who has obtained logon access to a MySQL Cluster infrastructure host - via credential theft, privilege escalation from a co-located workload, or insider access - targets the NDB Operator under specific, difficult-to-reproduce conditions required by the AC:H rating. By triggering the authentication bypass in the NDB Operator, the attacker reads all data accessible to the MySQL Cluster instance without supplying database-level credentials. No public exploit code has been identified at time of analysis.