CVE-2026-101781

A flaw was found in MySQL's Group Replication Group Communication System (GCS). An unauthenticated attacker located on the same adjacent network segment can exploit this vulnerability without requiring privileges or user interaction. Successful exploitation allows the attacker to take over the MySQL server, leading to unauthorized data disclosure, data modification, and denial of service.

This vulnerability is rated as Important because an unauthenticated adjacent attacker can achieve complete system compromise without requiring prior privileges or user interaction. Standard MySQL installations on Red Hat Enterprise Linux do not enable Group Replication by default, leaving typical standalone deployments unaffected. Risk is confined to environments where Group Replication is actively configured and group communication ports are accessible from untrusted adjacent networks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network exposure by limiting communication on the Group Replication port to authorized cluster nodes using firewalld, or disable the Group Replication feature if it is not required.

1. Restrict the replication communication port (default TCP 33061) to trusted cluster peer IPs using firewalld:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<PEER_NODE_IP>" port port="33061" protocol="tcp" accept'

firewall-cmd --reload

2. Alternatively, if Group Replication is not required, stop the plugin within MySQL: mysql> STOP GROUP_REPLICATION; Ensure that plugin-load or group_replication startup parameters are removed or disabled in the MySQL configuration files under /etc/my.cnf or /etc/my.cnf.d/.

Caveats: Limiting network access requires specifying all legitimate member addresses; misconfiguration may prevent nodes from joining the replication cluster.

Warning: Reloading firewall rules or stopping the replication service will temporarily interrupt replication traffic and cluster synchronization.