MySQL · week of 26 Oct 2026
MySQL security note
Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.
What changed
GHSA-473q-m89c-ghf8 — Open the advisory
MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)
Fixed in 2.6.1
CVE-2026-101637 — Check if you run it
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).
Seen in 5.5.32-0ubuntu7 · 3 other packages on the advisory
CVE-2026-101629 — Check if you run it
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).
Seen in 5.5.32-0ubuntu7 · 3 other packages on the advisory
CVE-2026-101756 — Check if you run it
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS).
Seen in 5.5.32-0ubuntu7 · 3 other packages on the advisory
CVE-2026-101753 — Check if you run it
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: RAPID).
Seen in 5.5.32-0ubuntu7 · 3 other packages on the advisory
CVE-2026-101513 — Check if you run it
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB).
Seen in 5.5.32-0ubuntu7 · 3 other packages on the advisory
CVE-2026-101786 — Check if you run it
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).
Seen in 9.7.2-4 · 1 other packages on the advisory
What we still do not know
CVE-2026-96632 — Open the advisory
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
No version range is stored, so an installed version cannot be checked.
Share this note
MySQL security note, week of 26 Oct 2026: 7 records have a version a customer can check, and 1 still does not. https://zerodayfindings.com/technologies/mysql/notes/2026-W44