bettercap CVE-2026-8276

The MySQL Server module of bettercap must be explicitly enabled and listening on a network interface accessible to the attacker. The attacker must be able to send packets to the bettercap instance on the MySQL server port (default 3306 or custom-configured). The malformed packet must be a partial or specially crafted MySQL handshake packet (protocol version negotiation phase) with fewer than 37 bytes or manipulated capability flag values in bytes 4-5 of the handshake payload. Standard MySQL client connections will not trigger this flaw - only deliberate protocol violations or fuzzing will expose the vulnerability. The vulnerability does NOT require authentication, network access to a real MySQL backend, or user interaction. Exploitation is limited to the scope of the bettercap process itself (local information disclosure or process instability); there is no privilege escalation or remote code execution vector indicated by the CVSS vector or commit changes.

CVSS 4.0 base score of 2.9 with attack vector network, high complexity, and no special privileges required indicates a low-severity finding on paper. However, several signals warrant careful evaluation. The CVSS vector explicitly sets VA:L (availability of limited resources), which contradicts initial descriptions of 'integer coercion error' leading to information disclosure - the vector shows minimal impact. EPSS score not provided in input. The vulnerability is confirmed published (POC exists per description and GitHub PR #1266) but NOT listed in CISA KEV, indicating no confirmed active exploitation despite public availability. High attack complexity (AC:H) significantly limits real-world exploitability - this is not a trivial network-level attack. The integer parsing flaw occurs only during MySQL handshake when a client sends a deliberately malformed packet with fewer than 37 bytes or crafted capability flags; a normal MySQL client will not trigger this. Real-world impact is unclear: the CVSS suggests only non-critical resource availability risk, but the description claims information disclosure (contradicting the vector). Defenders should assess whether they deploy bettercap in production environments where MySQL credential interception is a real threat model; if bettercap is used only in controlled penetration testing labs, risk is minimal. The high complexity requirement and published (not actively exploited) status suggest this is a low-priority patch cycle issue unless actively targeted in your threat landscape.

An attacker on the same network as a bettercap instance with MySQL Server module enabled sends a specially crafted MySQL handshake response packet (fewer than 37 bytes or with manipulated capability flag bytes) to the fake MySQL server listening on the attacker-controlled network interface. The integer coercion flaw in packet parsing causes the capability flags field to be misinterpreted due to truncation, potentially leading to unexpected behavior such as failure to validate subsequent protocol steps or leakage of internal state information through error messages or subsequent packet handling. Successful triggering requires crafting a valid partial MySQL protocol message, making this a high-complexity attack suitable for targeted exploitation during penetration testing or network manipulation scenarios.