MySQL Cluster EUVD-2026-106036

Exploitation requires (1) network access to the MySQL Cluster NDB Operator over HTTP, and (2) a valid low-privilege account on the target (CVSS PR:L), so this is authenticated rather than anonymous abuse. The specific triggering feature within the NDB Operator is not disclosed in the advisory. Limiting factors: the NDB Operator's HTTP endpoint must be reachable by the attacker (reducing exposure where it is network-segmented or confined to a trusted cluster control plane), and valid credentials are needed, so the realistic threat is a malicious or compromised authenticated tenant/operator user rather than an anonymous internet attacker. Impact is confined to availability - no data disclosure or modification is possible.

This is a moderate-priority availability flaw that should be patched in its normal cycle rather than treated as an emergency. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: network-reachable over HTTP, low attack complexity, requiring low-level privileges and no user interaction, with impact limited purely to availability (complete DoS via hang or repeatable crash) and zero confidentiality or integrity impact. There is no CISA KEV listing, no EPSS probability supplied, and no evidence of public exploit code, so the exploitation signal is: no public exploit identified at time of analysis. The signals do not conflict - a 6.5 availability-only bug requiring authentication (PR:L) is a genuine but bounded risk, not a drop-everything emergency. Note that EPSS is absent entirely (not low - simply not provided), so probability-of-exploitation cannot be quantified; the main escalating factor would be exposure of the NDB Operator's HTTP interface to untrusted but authenticated users, typical in multi-tenant Kubernetes environments.

An attacker who already holds low-privilege credentials for the MySQL Cluster environment sends crafted HTTP requests to the NDB Operator's network-exposed interface, triggering a condition that hangs or repeatedly crashes the cluster and produces a complete denial of service. No public proof-of-concept is known, and low attack complexity means the request itself is not technically demanding once authenticated access and network reachability exist. The absence of confidentiality/integrity impact means the attacker cannot read or alter data - only disrupt availability.