MySQL Server EUVD-2026-106198

Exploitation requires a victim to actively run the mysqldump client against an attacker-controlled, malicious, or MITM'd MySQL Server/Cluster endpoint over the network ('multiple protocols'); the flaw is in the client component, not the listening server. Limiting factors: Oracle rates it 'difficult to exploit' (AC:H), it requires human interaction from someone other than the attacker (UI:R, e.g. an operator initiating a dump), and it affects only specific recent branches - MySQL Server 8.4.0-8.4.12 / 9.7.0-9.7.3 / 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49 / 8.4.0-8.4.12 / 9.7.0-9.7.3 / 26.7.0-26.7.1. No authentication to the attacker's endpoint is needed (PR:N), but the client-side delivery and user-action requirement prevent unattended or server-facing exploitation.

This is a genuinely high-severity flaw (CVSS 7.5) but with real-world risk tempered by several limiting signals. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H shows network reach and no authentication (PR:N), but two factors sharply constrain it: high attack complexity (AC:H, Oracle explicitly calls it 'difficult to exploit') and required human interaction (UI:R) from a person other than the attacker. Critically, the affected component is 'Client: mysqldump' - a client utility, not the server daemon - so despite AV:N this is a client-side attack where a victim must run mysqldump against an attacker-controlled or malicious MySQL endpoint; this nuance reconciles the network vector with the human-interaction requirement. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified, so there is no present evidence of exploitation. Net assessment: patch in the normal Oracle CPU cycle rather than as an emergency - the full-takeover impact (C:H/I:H/A:H) justifies attention, but AC:H + UI:R + client-side delivery make mass or automated exploitation unlikely. The 'Information Disclosure' tag understates the stated impact, which is full takeover across confidentiality, integrity and availability - treat the tag as unreliable.

An attacker stands up a malicious or compromised MySQL server (or performs an active network position/MITM against multiple protocols) and lures a database operator into running mysqldump against it. When the mysqldump client processes crafted server responses, the flaw is triggered, resulting in takeover of the host running the client. No public proof-of-concept is known, and successful exploitation is rated difficult.