CVE-2026-60182·MySQL vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Severity
- medium
- Software
- MySQL
- Fixed in
- 8.0.46-0ubuntu0.22.04.4
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.34% — higher than 26% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 8.4.0
Until: 8.4.10
Fixed in: 8.0.46-0ubuntu0.22.04.4
How to fix this CVE
Update MySQL Server to version 8.0.46 or later to patch the Clone Plugin vulnerability that allows high-privileged attackers to trigger denial-of-service conditions. Organizations running affected versions (8.4.0–8.4.10, 9.7.0–9.7.1) should prioritize this update, as successful exploitation can cause complete service outages. Apply the patch during a maintenance window to minimize disruption.
sudo dnf update mysql-serverDefensia detects this vulnerability
How to check if you are affected
- Check installed MySQL version: mysql --version or mysql -u root -p -e 'SELECT VERSION();'
- Verify Clone Plugin is enabled: mysql -u root -p -e 'SHOW PLUGINS;' | grep -i clone
- Monitor error logs for repeated server crashes or connection hangs: tail -f /var/log/mysql/error.log | grep -E '(crash|hang|InnoDB|Clone)'
- Confirm patch installation: mysql -u root -p -e 'SELECT VERSION();' and verify output shows 8.0.46 or later
FAQ
What is CVE-2026-60182?
This is a denial-of-service vulnerability in MySQL's Clone Plugin that permits high-privileged attackers to repeatedly crash or hang the database server through network access, resulting in complete service unavailability.
Is CVE-2026-60182 being actively exploited?
No, this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploits are available. However, organizations should still patch promptly given the high-privileged access requirement.
What versions of MySQL are affected by CVE-2026-60182?
MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0–9.7.1 are affected, as well as MySQL Cluster 8.0.0–8.0.47, 8.4.0–8.4.10, and 9.7.0–9.7.1.
How do I check if my server is vulnerable to CVE-2026-60182?
Run mysql -u root -p -e 'SELECT VERSION();' to retrieve your installed version. If it falls within 8.4.0–8.4.10 or 9.7.0–9.7.1, your server is vulnerable. Then verify the Clone Plugin is loaded: SHOW PLUGINS; | grep -i clone.
Does Defensia detect CVE-2026-60182?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MySQL is installed on a monitored server, CVE-2026-60182 will appear in your dashboard with remediation steps.
Related MySQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-60182. Free for 1 server.
Get started free