{"id":"CVE-2026-101800","title":"mysql: mysql: unauthorized data access via improper privilege controls (CVE-2026-101800)","summary":"A flaw was found in the Security: Privileges component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvssSource":"vendor","cwe":"CWE-269","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","affected":["enterprise_linux 10","enterprise_linux 9"],"published":"2026-10-20","updated":"2026-10-23","sourceUpdated":"2026-10-23T00:09:59+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101800.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101800.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-101800"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557388"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101800"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101800"},{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00261,"epssPercentile":0.17757,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-22T15:12:36.478771Z"},"ingestedAt":"2026-10-20T22:23:33.916Z","slug":"CVE-2026-101800","body":"## Overview\n\nA flaw was found in the Security: Privileges component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101800.json)\n\n**mysql: mysql: unauthorized data access via improper privilege controls** — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Hardened Images\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- To reduce exposure to this vulnerability, restrict network reachability to the MySQL database server so that only trusted hosts and application tiers can establish connections.\n\n1. Restrict incoming traffic using firewalld to only authorized IP addresses:\n```bash\nfirewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<trusted_ip>\" port port=\"3306\" protocol=\"tcp\" accept'\nfirewall-cmd --reload\n```\n\n2. If remote database connections are not required, bind the MySQL daemon to …","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}