CVE-2026-46861: Vulnerability in the MySQL NDB Cluster product of Oracle MySQL (component: Cluster: NDB Operator)

Synopsis

An authorization or access-control vulnerability in the MySQL NDB Cluster NDB Operator component allows a low-privileged attacker to reach the service over the network via HTTP and fully compromise the cluster. No authentication beyond a basic low-privilege account is needed, and no victim interaction is required. Successful exploitation gives the attacker complete read access to all cluster data and the ability to create, modify, or delete any data in the cluster, with a scope change that means other products sharing the environment can also be affected. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the NDB Operator HTTP endpoint over the network; the service is exposed via HTTP and reachable from any host with network access to it.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker does not need administrative or elevated credentials, but some valid credential is required.

• Victim interactionNot required

  No user or administrator action is needed to trigger the vulnerability; the attacker can exploit it entirely through their own requests.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of target-specific state.

Blast Radius

• Reads all data stored in the MySQL NDB Cluster, including tables the attacker's account was not explicitly granted access to.
• Creates, modifies, or deletes any rows or objects within the NDB Cluster, including critical or privileged data.
• The scope change means other products or services running alongside the NDB Cluster in the same environment can also be compromised as a result of a successful attack.