CVE-2026-46860

Undergoing Analysis Undergoing Analysis - In Progress

Authentication Bypass in MySQL Router

Publication date: 2026-06-17

Last updated on: 2026-06-18

Assigner: Oracle

Description

Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router. Successful attacks of this vulnerability can result in takeover of MySQL Router. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-18

Generated

2026-07-08

AI Q&A

2026-06-17

EPSS Evaluated

2026-07-06

NVD

CVE-2026-46860

EUVD

EUVD-2026-37353

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	mysql_router	From 9.0.0 (inc) to 9.7.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the MySQL Router product of Oracle MySQL, specifically affecting versions 9.0.0 through 9.7.0. It is an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise the MySQL Router.

A successful attack can lead to a complete takeover of the MySQL Router, impacting confidentiality, integrity, and availability of the system.

Impact Analysis

If exploited, this vulnerability can allow an attacker to take over the MySQL Router without any authentication, which means the attacker can potentially control or disrupt database routing operations.

Loss of confidentiality: sensitive data handled by the router could be exposed.
Loss of integrity: data or routing configurations could be altered maliciously.
Loss of availability: the router service could be disrupted, causing denial of service.

Compliance Impact

This vulnerability allows an unauthenticated attacker with network access to fully compromise the MySQL Router, resulting in complete loss of confidentiality, integrity, and availability.

Such a compromise could lead to unauthorized access to sensitive data or disruption of services, which may violate requirements of common standards and regulations such as GDPR and HIPAA that mandate protection of personal and health information.

Therefore, organizations using affected versions of MySQL Router may face increased risk of non-compliance if this vulnerability is exploited.

Hi! I’m here to help you understand CVE-2026-46860. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70