This vulnerability (CVE-2026-60569) affects the MySQL Cluster product from Oracle, specifically the Cluster: NDB Operator component. It impacts versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. The flaw allows an unauthenticated attacker who has logon access to the infrastructure where MySQL Cluster runs to compromise the cluster, potentially leading to unauthorized access to critical or all accessible data. The CVSS 3.1 base score is 5.1, reflecting a medium severity with a vector indicating local attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not provide a specific patch or remediation level for it. There are no known exploits in the wild at this time.

Successful exploitation can result in unauthorized access to critical or all data accessible by the MySQL Cluster. The vulnerability does not affect data integrity or availability but compromises confidentiality. The attack requires local access to the infrastructure where MySQL Cluster executes and is considered difficult to exploit due to high attack complexity and no privileges required.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability; however, no explicit patch or remediation level is currently provided for CVE-2026-60569. Users should monitor the Oracle advisory for updates and apply any relevant patches promptly once available. Until then, ensure that access to the infrastructure hosting MySQL Cluster is tightly controlled to prevent unauthorized logon. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.