MySQL NDB Cluster EUVD-2026-37354

Attacker must have network reachability to the MySQL NDB Cluster's NDB Operator HTTP interface and must hold low-privilege credentials valid against that interface (PR:L, not PR:N), so fully unauthenticated exploitation is not indicated by the CVSS vector despite the 'Authentication Bypass' tag. No user interaction is required (UI:N), attack complexity is low (AC:L), and the target must be running an affected version (8.0.11-8.0.46, 8.4.0-8.4.9, or 9.0.0-9.7.0) with the NDB Operator component deployed - installations of plain MySQL Server or NDB Cluster without the Kubernetes operator are not in scope. Deployments where the operator's HTTP endpoint is exposed only to a hardened management network and where low-privilege accounts are tightly restricted face materially reduced exposure.

All signals converge on high real-world risk: CVSS 3.1 9.6 with AV:N/AC:L/PR:L/UI:N indicates trivially exploitable over the network by any user holding minimal credentials, S:C extends blast radius beyond the vulnerable component, and C:H/I:H mean full read and tamper of cluster data. Oracle's own description calling it 'easily exploitable' reinforces low exploitation complexity. Counter-balancing factors: A:N (no availability impact), no EPSS score provided in the input, no public POC identified, and not currently in CISA KEV - so exploitation is plausible but not yet observed. The 'Authentication Bypass' tag conflicts slightly with PR:L in the vector (low privileges still required, not none); defenders should verify with Oracle whether any pre-auth path exists. Given NDB Cluster's typical role as a backing store for telco/financial OLTP workloads, the combination of scope change and full C/I impact warrants treating this as a priority patch despite the absence of known exploitation.

A tenant in a shared Kubernetes cluster, or a compromised CI/CD service account with minimal credentials to the namespace running the NDB Operator, sends a crafted HTTP request to the operator's control endpoint and abuses the authorization flaw to read and rewrite NDB Cluster data outside its intended scope. Because the scope changes (S:C), the impact extends beyond the operator's own permissions to all data managed by the NDB Cluster it controls, including data belonging to other tenants or applications. No public exploit identified at time of analysis, but the AC:L rating implies a stable, reproducible exploit could be developed quickly once the patch is diffed.