What is the CVSS score of CVE-2026-60569?

CVE-2026-60569 has a CVSS 3.1 base score of 5.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

MySQL Cluster CVE-2026-60569

EUVD-2026-46931 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-888p-f43x-mg72

Authentication Bypass Oracle Mysql Cluster

5.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.1 MEDIUM

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.1 MEDIUM

Local-only access (AV:L) and high complexity (AC:H) per description; no privileges required on host; confidentiality-only impact with no integrity or availability consequence.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:08 vuln.today

DescriptionCVE.org

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Cluster executes to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Cluster accessible data. CVSS 3.1 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

MySQL Cluster's NDB Operator component allows a local, unauthenticated attacker with logon access to the infrastructure host to bypass authentication controls and gain complete read access to all MySQL Cluster data. Three active release lines are affected - 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 - as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) together with the local-only access vector (AV:L) substantially constrain realistic exploitation, though the data-exposure consequence remains significant for environments handling sensitive workloads.

Technical ContextAI

MySQL Cluster (NDB Cluster) is Oracle's shared-nothing, distributed in-memory database engineered for high availability and carrier-grade throughput. The NDB Operator is the Kubernetes-native component responsible for managing cluster lifecycle operations - provisioning, scaling, and configuration - within container orchestration environments. The CVE is tagged 'Authentication Bypass,' pointing to a failure in the NDB Operator to enforce authentication for certain local operations or interfaces, broadly consistent with CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function), though Oracle did not assign a formal CWE. The CVSS local attack vector (AV:L) is consistent with the description's language of 'logon to the infrastructure where MySQL Cluster executes,' indicating the flaw surfaces at the host or operator-process level rather than over the network. No CPE strings were supplied in the intelligence data.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update patches, available through the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Exact patched version numbers were not confirmed in the available intelligence data - consult the Oracle advisory directly to identify the precise fixed releases for each affected branch (8.0.x, 8.4.x, 9.7.x). While patching, restrict logon access to the hosts running MySQL Cluster to the minimum required set of trusted administrators, directly shrinking the pool of principals who can satisfy the local access prerequisite; note this may affect legitimate cluster management workflows. Additionally, enforce OS-level access controls on the NDB Operator process and review audit logs for anomalous data access patterns. If running NDB Operator in Kubernetes, apply RBAC and Pod Security Admission policies to limit which principals can interact with the operator pod.