MySQL Connector/Python EUVD-2026-106322

Exploitation requires the target to be running Oracle MySQL Connector/Python at the specifically affected version 26.7.0 and to be reachable over the network via one of its supported protocols. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required and default configurations appear sufficient; the description names no special feature flag or configuration mode. Limiting factors: impact is confidentiality-only (no integrity or availability loss), exposure is constrained to the single listed version 26.7.0, and the connector must be network-accessible to the attacker rather than isolated behind application or network controls.

This is a genuine but bounded concern rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated issue, which maps cleanly to the description's claim of an 'unauthenticated attacker with network access via multiple protocols.' However, impact is confidentiality-only (C:H/I:N/A:N) - there is no integrity or availability effect - so the 7.5 'High' score is driven entirely by data exposure, not system takeover. Critically, NO additional exploitation signals are present: EPSS probability is NOT provided in the input, there is NO CISA KEV listing, and NO public proof-of-concept is referenced, so real-world exploitation pressure cannot be confirmed and should be treated as currently unproven. The description is an Oracle Critical Patch Update generic template ('can result in unauthorized access to critical data'), which gives no concrete root cause and no CWE, limiting confidence in the true mechanism. The 'Authentication Bypass' tag conflicts with the description and vector, which describe an inherently unauthenticated confidentiality disclosure rather than a bypass of an authentication control - verify the mechanism with Oracle. Net: prioritize patching as part of normal cycle for exposed Connector/Python 26.7.0 deployments, but absent EPSS/KEV/POC signals this is not evidence of active, widespread attack.

An attacker with network reachability to a system or service using MySQL Connector/Python 26.7.0 sends traffic over one of the supported protocols to trigger the flaw and read data that should be protected, without needing credentials. Because impact is confidentiality-only, the outcome is disclosure of sensitive data handled by the connector rather than code execution or service disruption. No public proof-of-concept exploit is referenced in the available data.