MySQL Server CVE-2026-61096

Exploitation requires the attacker to have local logon access to the underlying infrastructure where MySQL Server or MySQL Cluster is executing (AV:L). No MySQL-level credentials or privileges are required (PR:N per CVSS), but OS-level infrastructure access is a hard prerequisite. Attack complexity is High (AC:H), meaning specific, non-default or difficult-to-control conditions must exist at exploitation time - likely a particular state or race condition within the Pluggable Auth subsystem. The exact triggering condition is not detailed in available public disclosures. The impact is limited to unauthorized data modification (INSERT/UPDATE/DELETE) against only a subset of accessible MySQL data, with no confidentiality exposure and no availability impact. Exploitation is blocked for remote, network-based attackers with no host access; it is also unlikely to be reliably repeatable due to high complexity requirements.

Despite the 'Authentication Bypass' tag, real-world risk from this vulnerability is substantially constrained. The CVSS 3.1 score of 2.9 reflects a confluence of limiting factors: AV:L requires physical or logical logon to the infrastructure host rather than a remote network path; AC:H indicates that exploitation is not straightforward and depends on specific, difficult-to-reproduce conditions; and the impact is bounded to I:L - limited, unauthorized write/insert/delete operations against a subset of accessible data, with no confidentiality or availability impact. No EPSS score was provided, and the vulnerability is not listed in the CISA KEV catalog, with no public exploit code identified. The 'unauthenticated' qualifier in the description (PR:N) means no MySQL-level credentials are required, but this does NOT eliminate the need for OS-level infrastructure access, which is itself a significant prerequisite. This combination renders the vulnerability low priority for most environments; however, multi-tenant environments or hosting providers where untrusted users share the same underlying infrastructure as a MySQL deployment should assess exposure more carefully. There is no signal conflict in the available data - all indicators consistently point to a low-risk, narrowly exploitable issue.

An attacker who has already obtained local access to the server or VM hosting MySQL - for example, a malicious co-tenant in a shared environment, a compromised service account, or an insider - exploits a high-complexity condition in the Pluggable Auth subsystem without needing MySQL credentials. Under specific, difficult-to-trigger circumstances, the attacker is able to bypass the authentication check and issue unauthorized INSERT, UPDATE, or DELETE statements against a limited subset of accessible MySQL data. No public exploit code exists at time of analysis, and reproducing the AC:H conditions adds a meaningful barrier.