CVE-2026-60191·MySQL vulnerability
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
- Severity
- medium
- Software
- MySQL
- Fixed in
- 8.0.46-0ubuntu0.22.04.4
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.13% — higher than 3% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 8.4.0
Until: 8.4.10
Fixed in: 8.0.46-0ubuntu0.22.04.4
How to fix this CVE
Update MySQL Server to version 8.0.46 or later to resolve this replication component vulnerability that can cause service unavailability. This patch addresses a local privilege escalation flaw affecting the replication subsystem that requires high-level database access to exploit. Apply updates during a maintenance window and verify replication status post-deployment.
sudo dnf update mysql-serverDefensia detects this vulnerability
How to check if you are affected
- Run 'mysql --version' or 'SELECT VERSION();' within MySQL client to identify the installed version and compare against the affected range (8.4.0-8.4.10, 9.7.0-9.7.1, 8.0.0-8.0.47 for Cluster)
- Execute 'SHOW SLAVE STATUS\G;' or 'SHOW REPLICA STATUS\G;' to verify replication is active and identify if the replication component is in use on the system
- Search MySQL error logs (typically /var/log/mysql/error.log) for unexpected server crashes or 'hang' events using: grep -i 'crash\|hang\|exit' /var/log/mysql/error.log | tail -100
- After patching, confirm the updated version with 'SELECT VERSION();' and validate replication functionality remains healthy with 'SHOW REPLICA STATUS\G;' to ensure the fix is properly applied
FAQ
What is CVE-2026-60191?
CVE-2026-60191 is a denial-of-service vulnerability in MySQL's replication component that allows high-privileged local attackers to trigger server hangs or crashes, resulting in complete service unavailability without affecting data confidentiality or integrity.
Is CVE-2026-60191 being actively exploited?
No, there is no evidence of active exploitation in the wild, and no public exploit code is available for this vulnerability.
What versions of MySQL are affected by CVE-2026-60191?
Affected versions include MySQL Server 8.4.0 through 8.4.10, 9.7.0 through 9.7.1, and MySQL Cluster 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1.
How do I check if my server is vulnerable to CVE-2026-60191?
Connect to MySQL as root and run 'SELECT VERSION();' to retrieve your version number, then cross-reference it against the affected version ranges listed in the security advisory.
Does Defensia detect CVE-2026-60191?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MySQL is installed on a monitored server, CVE-2026-60191 will appear in your dashboard with remediation steps.
Related MySQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-60191. Free for 1 server.
Get started free