CVE-2026-101781High· 8.8▾ Twilight

mysql: mysql: Server takeover via Group Replication GCS (CVE-2026-101781)

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score48/ 100 · Moderate

impact 48.4 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 20, 2026

Updated

Oct 22, 2026

CVSS

8.8

Vendor

Red Hat

Product

Red Hat Enterprise Linux 10

CWE

CWE-306

Depth score

48 · Moderate

EPSS

0.28% · p20

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-22

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 22.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 6 days

Oct 20, 2026Published
Disclosed via CSAF
Oct 22, 2026Record revised
Last analysed / modified upstream
Oct 22, 2026EPSS first tracked
0.3%
Oct 26, 2026EPSS peak
0.3% → 0.3%

Red Hat CWE-306 #csaf #vex #red-hat #cve.org

Affected

enterprise_linux 10
enterprise_linux 9

Full technical detail▾

Overview

A flaw was found in MySQL's Group Replication Group Communication System (GCS). An unauthenticated attacker located on the same adjacent network segment can exploit this vulnerability without requiring privileges or user interaction. Successful exploitation allows the attacker to take over the MySQL server, leading to unauthorized data disclosure, data modification, and denial of service.

Vendor advisories

Red Hat VEX · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-22 · vex

mysql: mysql: Server takeover via Group Replication GCS — rated Important by Red Hat. Released 2026-10-20, updated 2026-10-22.

Affected:

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9

No fix planned:

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9

Not affected:

Red Hat Enterprise Linux 6
Red Hat Hardened Images

Remediation

Affected

Workarounds / mitigations:

Restrict network exposure by limiting communication on the Group Replication port to authorized cluster nodes using firewalld, or disable the Group Replication feature if it is not required.

Restrict the replication communication port (default TCP 33061) to trusted cluster peer IPs using firewalld:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<PEER_NODE_IP>" port port="33061" protocol="tcp" accept'

firewall-cmd --reload

Alternatively, if Group Replica…

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#cve.org

← Back to feed

CVE-2026-101781High· 8.8▾ Twilight

mysql: mysql: Server takeover via Group Replication GCS (CVE-2026-101781)

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score48/ 100 · Moderate

impact 48.4 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 20, 2026

Updated

Oct 22, 2026

CVSS

8.8

Vendor

Red Hat

Product

Red Hat Enterprise Linux 10

CWE

CWE-306

Depth score

48 · Moderate

EPSS

0.28% · p20

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-22

Exploitation: none
Automatable: no
Technical impact: total

EPSS history

Exploit-prediction probability, daily snapshots since Oct 22.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 6 days

Oct 20, 2026Published
Disclosed via CSAF
Oct 22, 2026Record revised
Last analysed / modified upstream
Oct 22, 2026EPSS first tracked
0.3%
Oct 26, 2026EPSS peak
0.3% → 0.3%

Red Hat CWE-306 #csaf #vex #red-hat #cve.org

Affected

enterprise_linux 10
enterprise_linux 9

Full technical detail▾

Overview

Vendor advisories

Red Hat VEX · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-22 · vex

mysql: mysql: Server takeover via Group Replication GCS — rated Important by Red Hat. Released 2026-10-20, updated 2026-10-22.

Affected:

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9

No fix planned:

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9

Not affected:

Red Hat Enterprise Linux 6
Red Hat Hardened Images

Remediation

Affected

Workarounds / mitigations:

Restrict network exposure by limiting communication on the Group Replication port to authorized cluster nodes using firewalld, or disable the Group Replication feature if it is not required.

Restrict the replication communication port (default TCP 33061) to trusted cluster peer IPs using firewalld:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<PEER_NODE_IP>" port port="33061" protocol="tcp" accept'

firewall-cmd --reload

Alternatively, if Group Replica…

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#cve.org