Listen to this Post
How the CVE Works
CVE-2025-50068 is a privilege escalation vulnerability in Oracle MySQL Cluster (versions 8.0.0-8.0.42, 8.4.0-8.4.5, and 9.0.0-9.3.0). The flaw resides in the Cluster General component, allowing a high-privileged attacker with local network access to execute arbitrary code and fully compromise the MySQL Cluster service. The vulnerability stems from improper access control checks during cluster node communication, enabling an authenticated attacker to bypass security restrictions and gain elevated privileges. Successful exploitation leads to complete cluster takeover, impacting confidentiality, integrity, and availability. The CVSS 3.1 score of 6.7 (High) reflects its low attack complexity and high impact under local access scenarios.
DailyCVE Form
Platform: MySQL Cluster
Version: 8.0.0-9.3.0
Vulnerability: Privilege Escalation
Severity: Critical
Date: 07/24/2025
Prediction: Patch by 09/2025
What Undercode Say
SHOW VARIABLES LIKE '%version%'; SELECT FROM mysql.user WHERE Super_priv='Y'; EXPLOIT: Malicious node injection
How Exploit
- Attacker authenticates to cluster node.
- Sends crafted packet to escalate privileges.
- Gains full cluster control.
Protection from this CVE
- Apply Oracle’s upcoming patch.
- Restrict cluster node access.
- Monitor unauthorized privilege changes.
Impact
- Full cluster compromise.
- Data theft/modification.
- Service disruption.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
