MySQL Server EUVD-2026-106151

Exploitation requires an attacker to already hold a HIGH-privileged MySQL account (PR:H) and network reachability to the database via one of its supported protocols; the flaw is in the Server: Clone Plugin component, so an environment using or exposing clone functionality is the relevant deployment context. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. The dominant limiting factor is the privileged-account prerequisite: without an existing high-privilege credential there is no path to exploitation, which confines realistic risk to insiders or post-compromise scenarios rather than anonymous internet attackers. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once privileged access exists the DoS is reliable.

This is a moderate-severity, availability-only issue that most teams should treat as a patch-in-normal-cycle item rather than an emergency. The CVSS 3.1 base score is 4.9 (MEDIUM) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H: network-reachable and low attack complexity, but critically requiring HIGH privileges (PR:H) - i.e. an attacker who already holds a privileged MySQL account. Impact is confined to availability (A:H; C:N/I:N) - a hang or repeatable crash producing a complete DoS of the database - with no confidentiality or integrity exposure and no scope change (S:U). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The key tension is that Oracle's description calls this 'easily exploitable,' yet the PR:H requirement means the realistic threat actor is an authenticated insider or someone who has already compromised privileged DB credentials - this sharply narrows the practical attacker population and is the single most important risk-limiting factor. Net: real but low-priority for internet-edge triage; higher concern in multi-tenant or shared-DBA environments where privileged accounts are broadly distributed.

An attacker who already possesses a high-privileged MySQL account (e.g. a malicious or compromised DBA/service account) connects over the network via one of the supported protocols and issues a crafted operation against the Clone Plugin component, causing the server to hang or repeatedly crash and denying service to all users. No public proof-of-concept is referenced, and low attack complexity (AC:L) means the action is reliable once privileged access is held. Impact is a complete database outage with no data disclosure or modification.