CVE-2026-60569

{
  "id": "CVE-2026-60569",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:17:57.147",
  "lastModified": "2026-10-24T18:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator).  Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Cluster executes to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Cluster accessible data. CVSS 3.1 Base Score 5.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto MySQL Cluster de Oracle MySQL (componente: Cluster: NDB Operator). Versiones soportadas que están afectadas son 8.0.0-8.0.47, 8.4.0-8.4.10 y 9.7.0-9.7.1. Dificil de exploit vulnerabilidad permite a un atacante no autenticado con inicio de sesión en la infraestructura donde MySQL Cluster se ejecuta comprometer MySQL Cluster. Ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a datos críticos o acceso completo a todos los datos accesibles de MySQL Cluster. CVSS 3.1 Puntuación Base 5.1 (Impactos en la Confidencialidad). Vector CVSS: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "MySQL Cluster",
          "versions": [
            {
              "version": "8.0.0",
              "lessThanOrEqual": "8.0.47",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "8.4.0",
              "lessThanOrEqual": "8.4.10",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "9.7.0",
              "lessThanOrEqual": "9.7.1",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.4,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-25T03:56:13.710712Z",
          "id": "CVE-2026-60569",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0",
              "versionEndIncluding": "8.0.47",
              "matchCriteriaId": "AD39D6D1-36B9-403D-A8BD-3480AE92E9E7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.4.0",
              "versionEndIncluding": "8.4.10",
              "matchCriteriaId": "E6FD5365-6FD2-412C-B844-F0D29A9DD757"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:mysql_cluster:9.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D804257D-F6E5-462B-AF71-48738704F36A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:mysql_cluster:9.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9B75B87-48CD-4224-A585-E4D75492C5DB"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}