MySQL NDB Cluster Vulnerability in Oracle MySQL Product
CVE-2026-46861

9.6CRITICAL

Key Information:

Vendor

Oracle
Status
Mysql Ndb Cluster
Vendor
CVE Published:
16 June 2026

What is CVE-2026-46861?

A vulnerability exists within the MySQL NDB Cluster component of Oracle MySQL that allows a low privileged attacker to exploit this weakness with network access via HTTP. Successful exploitation permits such attackers to compromise the NDB Cluster, potentially leading to unauthorized actions including the creation, deletion, or modification of critical data. The impact of such an attack may extend beyond the NDB Cluster itself, affecting any related products due to scope changes resulting from successful exploits. This poses significant risks to data confidentiality and integrity in affected systems.

Affected Version(s)

MySQL NDB Cluster 8.0.11 <= 8.0.46

MySQL NDB Cluster 8.4.0 <= 8.4.9

MySQL NDB Cluster 9.0.0 <= 9.7.0

References

https://www.oracle.com/security-alerts/cspujun2026.html
vendor-advisory

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.