---
id: CVE-2026-101800
title: >-
  mysql: mysql: unauthorized data access via improper privilege controls
  (CVE-2026-101800)
summary: >-
  A flaw was found in the Security: Privileges component of MySQL. This issue
  may allow an attacker to impact the confidentiality, integrity, and/or
  availability of MySQL Server depending on the vulnerability details. Refer to
  the Oracle CPU…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: vendor
cwe: CWE-269
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - enterprise_linux 10
  - enterprise_linux 9
published: '2026-10-20'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T00:09:59+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101800.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101800.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-101800'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2557388'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-101800'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101800'
  - url: 'https://www.oracle.com/security-alerts/cpuoct2026.html'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00261
epssPercentile: 0.17757
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-22T15:12:36.478771Z'
ingestedAt: '2026-10-20T22:23:33.916Z'
---

## Overview

A flaw was found in the Security: Privileges component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101800.json)

**mysql: mysql: unauthorized data access via improper privilege controls** — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-23.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat Enterprise Linux 6
- Red Hat Hardened Images

## Remediation

Affected

Workarounds / mitigations:

- To reduce exposure to this vulnerability, restrict network reachability to the MySQL database server so that only trusted hosts and application tiers can establish connections.

1. Restrict incoming traffic using firewalld to only authorized IP addresses:
```bash
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_ip>" port port="3306" protocol="tcp" accept'
firewall-cmd --reload
```

2. If remote database connections are not required, bind the MySQL daemon to …