CVE-2026-101800

A flaw was found in the Security: Privileges component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for component-specific impact.

Red Hat Product Security rates this vulnerability as Important because an unauthenticated network adversary can alter database records or disrupt service availability, despite the elevated attack complexity involved. In standard Red Hat Enterprise Linux deployments, MySQL is not accessible to public networks by default and requires explicit configuration for remote access or replication clustering. Consequently, systems running in isolated environments or configurations where network traffic to replication endpoints is restricted face lower practical exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce exposure to this vulnerability, restrict network reachability to the MySQL database server so that only trusted hosts and application tiers can establish connections.

1. Restrict incoming traffic using firewalld to only authorized IP addresses:

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_ip>" port port="3306" protocol="tcp" accept'
firewall-cmd --reload

2. If remote database connections are not required, bind the MySQL daemon to the local loopback interface by adding the following line under the [mysqld] section in /etc/my.cnf or /etc/my.cnf.d/mysql-server.cnf:

[mysqld]
bind-address = 127.0.0.1

Apply the configuration change by restarting the daemon:

systemctl restart mysqld

Caveats: Restricting access to specific addresses or binding to localhost prevents unauthorized hosts from reaching the service, but external applications requiring database access must be explicitly permitted.

Warning: Modifying firewall rules or restarting the mysqld service will terminate existing database sessions and temporarily disrupt connectivity for running services.