---
id: CVE-2026-101781
title: 'mysql: mysql: Server takeover via Group Replication GCS (CVE-2026-101781)'
summary: >-
  A flaw was found in MySQL's Group Replication Group Communication System
  (GCS). An unauthenticated attacker located on the same adjacent network
  segment can exploit this vulnerability without requiring privileges or user
  interaction. Succe…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe: CWE-306
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - enterprise_linux 10
  - enterprise_linux 9
published: '2026-10-20'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T22:10:04+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101781.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101781.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-101781'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2557856'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-101781'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101781'
  - url: 'https://www.oracle.com/security-alerts/cpuoct2026.html'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00279
epssPercentile: 0.20202
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-22T15:12:25.121261Z'
ingestedAt: '2026-10-20T22:23:33.922Z'
---

## Overview

A flaw was found in MySQL's Group Replication Group Communication System (GCS). An unauthenticated attacker located on the same adjacent network segment can exploit this vulnerability without requiring privileges or user interaction. Successful exploitation allows the attacker to take over the MySQL server, leading to unauthorized data disclosure, data modification, and denial of service.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101781.json)

**mysql: mysql: Server takeover via Group Replication GCS** — rated Important by Red Hat. Released 2026-10-20, updated 2026-10-22.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat Enterprise Linux 6
- Red Hat Hardened Images

## Remediation

Affected

Workarounds / mitigations:

- Restrict network exposure by limiting communication on the Group Replication port to authorized cluster nodes using firewalld, or disable the Group Replication feature if it is not required.

1. Restrict the replication communication port (default TCP 33061) to trusted cluster peer IPs using firewalld:
# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<PEER_NODE_IP>" port port="33061" protocol="tcp" accept'
# firewall-cmd --reload

2. Alternatively, if Group Replica…