MySQL Server CVE-2026-61081

Exploitation requires a valid, high-privileged MySQL account (equivalent to DBA or administrative role, consistent with CVSS PR:H) with network connectivity to the MySQL Server or Cluster instance. The vulnerability is specific to the Performance Schema component - the attacker must interact with Performance Schema tables or instrumentation interfaces. No special non-default configuration is described as required beyond access to the Performance Schema, which is enabled by default in MySQL 5.6+ and cannot be trivially disabled without impact to monitoring tooling. Limiting factors: the high privilege requirement (PR:H) is the primary barrier - standard application-level or read-only database users cannot exploit this. No user interaction is required once the privileged session is established. Exploitation is bounded to confidentiality of a data subset; no write or denial-of-service capability is implied.

Real-world risk is low. The CVSS 3.1 score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) encodes the core constraint: exploitation requires a high-privileged account (PR:H), most likely a DBA or administrative user who already has broad access to sensitive database data. The confidentiality impact is limited (C:L), there is no integrity or availability impact, and scope is unchanged. The 'Authentication Bypass' tag in the intelligence metadata is potentially misleading or refers to a sub-component authorization bypass rather than full credential bypass - the CVSS PR:H rating is authoritative and should be trusted over the tag. No EPSS score is supplied; given the low CVSS, high privilege bar, and absence of a public POC or KEV listing, exploitation probability is presumed very low. This is not a priority patch in environments where database administrative accounts are appropriately controlled. The primary risk is insider threat or post-compromise lateral movement scenarios where an attacker with existing high-privilege database access uses this flaw to read additional data they were not explicitly granted.

An attacker who has already compromised a MySQL DBA or high-privileged service account - whether through credential theft, phishing, or prior system compromise - connects to the MySQL instance over the network using standard MySQL protocols. The attacker queries Performance Schema tables or views through the flaw to read data subsets that the internal authorization model should restrict, potentially exposing query history, user activity metadata, or other operational data not intended for that account's view. No public exploit code exists at time of analysis; this scenario assumes deliberate exploitation rather than opportunistic attack.