CVE-2026-34318
High-Privilege Network Access Vulnerability in Oracle MySQL Shell
Publication date: 2026-04-21
Last updated on: 2026-05-05
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | mysql | From 8.0.0 (inc) to 8.0.45 (inc) |
| oracle | mysql | From 8.4.0 (inc) to 8.4.8 (inc) |
| oracle | mysql | From 9.0.0 (inc) to 9.6.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the MySQL Shell product of Oracle MySQL, specifically in the Shell: Core Client component. It affects supported versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0.
The vulnerability is difficult to exploit and requires a high privileged attacker with network access through multiple protocols. If successfully exploited, it allows the attacker to compromise the MySQL Shell.
Although the vulnerability is in MySQL Shell, attacks may significantly impact additional products due to scope change.
Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible via MySQL Shell.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow a high privileged attacker with network access to gain unauthorized access to critical data within MySQL Shell.
The attacker could potentially access all data accessible through MySQL Shell, which may lead to data breaches or exposure of sensitive information.
Because the vulnerability affects multiple protocols and may impact additional products, the overall security of systems relying on MySQL Shell could be compromised.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a high privileged attacker with network access to compromise MySQL Shell, potentially resulting in unauthorized access to critical data or complete access to all MySQL Shell accessible data.
Such unauthorized access to sensitive or critical data could negatively impact compliance with data protection standards and regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.
However, specific impacts on compliance are not detailed in the provided information.