MySQL Cluster CVE-2026-60592

No special configuration is required beyond a reachable MySQL Cluster NDB Operator endpoint - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible, low-complexity, unauthenticated exploitation against default deployments of affected versions. Exploitation is limited by network exposure: NDB cluster management ports are typically not internet-facing in well-configured deployments, meaning risk is highest in environments where cluster management interfaces are reachable from untrusted network segments or where internal network segmentation is absent. Affected versions must be in the 8.0.0-8.0.47, 8.4.0-8.4.10, or 9.7.0-9.7.1 ranges; the specific protocol(s) triggering the flaw are not enumerated in available data.

The CVSS 3.1 score of 8.2 High is consistent with the underlying metrics: network-reachable, low complexity, no authentication, and high availability impact. The integrity impact is rated Low (I:L), reflecting partial data manipulation rather than full control. No EPSS data was provided in the intelligence package, so exploitation probability cannot be quantified. The CVE is not in the CISA KEV catalog and no POC code has been identified, suggesting exploitation is not yet widespread. However, the attack profile - unauthenticated, network-accessible, low complexity - means any operator with an NDB management port exposed should treat this as urgent regardless of organizational size; even a mid-sized municipal IT team in radom running MySQL Cluster for real-time services would face meaningful operational disruption from a repeatable crash. The primary real-world risk is availability: a DoS against MySQL Cluster in production environments supporting telecommunications, financial transactions, or other latency-sensitive workloads can have cascading impact. The I:L rating deserves attention as unauthorized data writes could affect data integrity even in brief exploitation windows.

An unauthenticated remote attacker sends a sequence of specially crafted requests over one of the protocols supported by the MySQL Cluster NDB Operator interface, triggering a crash or hang of the cluster management layer. With no authentication barrier and low attack complexity, this could be executed via an automated script against any exposed NDB management endpoint, causing a complete outage of the MySQL Cluster service. No public proof-of-concept code has been identified at time of analysis.