CVE-2026-46861: Privilege Escalation and Cluster Takeover in MySQL NDB Operator
HERMES THREAT SCORE & OPERATIONAL EXPOSURE
Target:MySQL NDB Cluster (Cluster: NDB Operator) — Oracle MySQL Enterprise & Community Ecosystem Hermes assigns a threat score of 92 (CRITICAL). In cloud-native Kubernetes environments, compromising the NDB Operator provides a direct pathway to mutate cluster CRDs, exfiltrate persistent storage volumes, and compromise neighboring pods across the Kubernetes tenant.
HASS INFRASTRUCTURE & AGENTIC IMPACT POSTURE
Target:Kubernetes Control Plane, Operator Controllers & Cloud Storage Modern automated database deployment pipelines, agentic query tooling, and Kubernetes operators rely on reliable boundaries. Compromising MySQL NDB Cluster (Cluster: NDB Operator) allows adversaries to pierce compartmentalization boundaries and expand footholds across adjacent infrastructure.
CVE-2026-46861: Privilege Escalation and Cluster Takeover in MySQL NDB OperatorVULNERABILITY
Software platform affected by security vulnerabilities and agentic attack patterns.
🔍 Why is this related? (Evidence & Provenance)
“Confirmed security vulnerability in Oracle MySQL NDB Cluster documented in Hermes dossier.”
- [vulnerability_report]
- [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)
1. Technical Context & Affected Software Matrix
Section titled “1. Technical Context & Affected Software Matrix”MySQL NDB Cluster (Cluster: NDB Operator) plays a central role within the Oracle MySQL ecosystem. Flaws in this layer expose both database assets and interconnecting applications.
| Parameter | Technical Specification | Operational Context |
|---|---|---|
| CVE Identifier | CVE-2026-46861 | Oracle CPU Record / NVD Reference |
| Component Name | MySQL NDB Cluster (Cluster: NDB Operator) | Oracle MySQL Ecosystem |
| Vulnerability Class | Kubernetes RBAC Bypass / Cluster Compromise | CWE-284 (Improper Access Control) |
| Network Vector | TCP 8080 / 9443 (Webhook & Operator HTTP API) | Low Privileged Network Access |
| Scope Impact | Scope Change (S:C) — Host/Cluster Escaping | Impact across trust boundaries |
| Affected Versions | MySQL NDB Cluster 8.0.11–8.0.46, 8.4.0–8.4.9, 9.0.0–9.7.0 | Prior releases lacking patch validation |
| Fixed Releases | 8.0.47, 8.4.10, 9.7.1 | Available in official Oracle distribution |
2. Root Cause Analysis & Architectural Flaw
Section titled “2. Root Cause Analysis & Architectural Flaw”Flaw Mechanism in MySQL NDB Cluster (Cluster: NDB Operator)
Section titled “Flaw Mechanism in MySQL NDB Cluster (Cluster: NDB Operator)”The vulnerability originates from insufficient input sanitization, improper access control, or incorrect privilege delegation within MySQL NDB Cluster (Cluster: NDB Operator).
+-------------------------------------------------------------------------+| ATTACK INGRESS || Attacker / Rogue Client ==[ AV:N ]==> MySQL NDB Cluster (Cluster: NDB Operator) |+-------------------------------------------------------------------------+ | v+-------------------------------------------------------------------------+| VULNERABILITY EXECUTION BOUNDARY || - Parsing & Verification Defect: CWE-284 (Improper Access Control) || - Security Boundary Failure: Breaks out into Host OS / Kubernetes |+-------------------------------------------------------------------------+ | v+-------------------------------------------------------------------------+| IMPACTED ASSETS || - Confidentiality: Full Host / DB Read || - Integrity: Arbitrary State Manipulation || - Availability: Limited |+-------------------------------------------------------------------------+When receiving requests over TCP 8080 / 9443 (Webhook & Operator HTTP API), the component fails to enforce strict boundary restrictions. An attacker capitalizing on this logic gap can manipulate execution state, invoke privileged RPC endpoints, or crash daemon routines.
3. Attack Chain & Weaponization Flow
Section titled “3. Attack Chain & Weaponization Flow”sequenceDiagram autonumber actor Attacker as Attacker / Compromised Client participant Target as MySQL NDB Cluster (Cluster: NDB Operator) participant Backend as Core Database / Host Runtime
Attacker->>Target: Transmit crafted payload over TCP 8080 / 9443 (Webhook & Operator HTTP API) Note over Target: Trigger logic bug: CWE-284 Target->>Backend: Execute unauthorized action / Unvalidated RPC Note over Backend: Scope Change triggered: Host breakout Backend-->>Attacker: Administrative access / Intercepted credentials / Denial of Service4. Forensic Triage & Detection Engineering
Section titled “4. Forensic Triage & Detection Engineering”title: Suspicious Activity Related to CVE-2026-46861 in MySQL NDB Cluster (Cluster: NDB Operator)id: cve-2026-46861-detection-sigmastatus: experimentaldescription: Detects suspicious process lineage or abnormal command execution related to CVE-2026-46861.references: - https://www.oracle.com/security-alerts/author: Hermes Codex Cyber Intelligencedate: 2026-09-15tags: - attack.initial_access - attack.execution - attack.t1190logsource: category: process_creation product: linuxdetection: selection_parent: ParentImage|endswith: - 'ndb-operator' selection_child: Image|endswith: - 'kubectl' condition: selection_parent and selection_childlevel: high# Suricata / Network IDS inspection signaturealert tcp any any -> any any (msg:"HERMES - Potential CVE-2026-46861 Exploitation Pattern in MySQL NDB Cluster (Cluster: NDB Operator)"; flow:to_server,established; content:"MySQL"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:46861; rev:1;)# Verify running version of MySQL NDB Cluster (Cluster: NDB Operator)mysql --version || mysqlrouter --version || mysqlsh --version
# Check for abnormal child processes spawned by database daemonsps -ef | grep -E "(ndb-operator|mysql)" | grep -E "(bash|sh|curl|wget|nc)"
# Audit network listening ports for unauthorized exposuress -tlpn | grep -E "()"5. Mitigation & Defense-in-Depth Remediation Steps
Section titled “5. Mitigation & Defense-in-Depth Remediation Steps”-
Apply Official Oracle Vendor Patches: Upgrade MySQL NDB Cluster (Cluster: NDB Operator) to release 8.0.47, 8.4.10, 9.7.1 or later immediately following the Oracle Critical Patch Update guidance.
-
Enforce Network Segmentation & Access Control: Restrict access to port
TCP 8080 / 9443 (Webhook & Operator HTTP API). Under no circumstances should management, routing, or internal shell RPC endpoints be exposed to the public Internet or untrusted subnets. -
Audit Privileges and Role Assignments: Review database user grants (
SUPER,REPLICATION SLAVE,BACKUP_ADMIN). Ensure the principle of least privilege is rigorously applied across application and operator service accounts. -
Rotate Infrastructure Credentials: If compromise or unauthorized access is suspected, immediately rotate database administrative passwords, TLS certificates, and Kubernetes service account tokens.