CVE-2026-60592: Unauthenticated Network Denial of Service and Data Tampering in NDB Operator
HERMES THREAT SCORE & OPERATIONAL EXPOSURE
Target:MySQL Cluster (Cluster: NDB Operator) — Oracle MySQL Enterprise & Community Ecosystem Hermes rates CVE-2026-60592 at 84 (HIGH). Remote unauthenticated callers can trigger cascading crashes in the Kubernetes operator controller, preventing failover operations and allowing stealthy alteration of cluster state.
HASS INFRASTRUCTURE & AGENTIC IMPACT POSTURE
Target:Cloud Native Database Operators & Kubernetes Reconcilers Modern automated database deployment pipelines, agentic query tooling, and Kubernetes operators rely on reliable boundaries. Compromising MySQL Cluster (Cluster: NDB Operator) allows adversaries to pierce compartmentalization boundaries and expand footholds across adjacent infrastructure.
CVE-2026-60592: Unauthenticated Network Denial of Service and Data Tampering in NDB OperatorVULNERABILITY
Software platform affected by security vulnerabilities and agentic attack patterns.
🔍 Why is this related? (Evidence & Provenance)
“Confirmed security vulnerability in Oracle MySQL NDB Cluster documented in Hermes dossier.”
- [vulnerability_report]
- [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)
1. Technical Context & Affected Software Matrix
Section titled “1. Technical Context & Affected Software Matrix”MySQL Cluster (Cluster: NDB Operator) plays a central role within the Oracle MySQL ecosystem. Flaws in this layer expose both database assets and interconnecting applications.
| Parameter | Technical Specification | Operational Context |
|---|---|---|
| CVE Identifier | CVE-2026-60592 | Oracle CPU Record / NVD Reference |
| Component Name | MySQL Cluster (Cluster: NDB Operator) | Oracle MySQL Ecosystem |
| Vulnerability Class | Unauthenticated DoS & State Tampering | CWE-284 (Improper Access Control) |
| Network Vector | TCP 9443 / 8080 | Unauthenticated Network Access |
| Scope Impact | Scope Unchanged (S:U) | Impact across trust boundaries |
| Affected Versions | MySQL NDB Operator prior to August 2026 maintenance release | Prior releases lacking patch validation |
| Fixed Releases | NDB Operator 8.0.47, 8.4.10, 9.7.1 | Available in official Oracle distribution |
2. Root Cause Analysis & Architectural Flaw
Section titled “2. Root Cause Analysis & Architectural Flaw”Flaw Mechanism in MySQL Cluster (Cluster: NDB Operator)
Section titled “Flaw Mechanism in MySQL Cluster (Cluster: NDB Operator)”The vulnerability originates from insufficient input sanitization, improper access control, or incorrect privilege delegation within MySQL Cluster (Cluster: NDB Operator).
+-------------------------------------------------------------------------+| ATTACK INGRESS || Attacker / Rogue Client ==[ AV:N ]==> MySQL Cluster (Cluster: NDB Operator) |+-------------------------------------------------------------------------+ | v+-------------------------------------------------------------------------+| VULNERABILITY EXECUTION BOUNDARY || - Parsing & Verification Defect: CWE-284 (Improper Access Control) || - Security Boundary Failure: Compromises DB Engine & Ingress State |+-------------------------------------------------------------------------+ | v+-------------------------------------------------------------------------+| IMPACTED ASSETS || - Confidentiality: Partial || - Integrity: Partial || - Availability: Full Denial of Service / Crash |+-------------------------------------------------------------------------+When receiving requests over TCP 9443 / 8080, the component fails to enforce strict boundary restrictions. An attacker capitalizing on this logic gap can manipulate execution state, invoke privileged RPC endpoints, or crash daemon routines.
3. Attack Chain & Weaponization Flow
Section titled “3. Attack Chain & Weaponization Flow”sequenceDiagram autonumber actor Attacker as Attacker / Compromised Client participant Target as MySQL Cluster (Cluster: NDB Operator) participant Backend as Core Database / Host Runtime
Attacker->>Target: Transmit crafted payload over TCP 9443 / 8080 Note over Target: Trigger logic bug: CWE-284 Target->>Backend: Execute unauthorized action / Unvalidated RPC Note over Backend: Takeover of routing/replication state Backend-->>Attacker: Administrative access / Intercepted credentials / Denial of Service4. Forensic Triage & Detection Engineering
Section titled “4. Forensic Triage & Detection Engineering”title: Suspicious Activity Related to CVE-2026-60592 in MySQL Cluster (Cluster: NDB Operator)id: cve-2026-60592-detection-sigmastatus: experimentaldescription: Detects suspicious process lineage or abnormal command execution related to CVE-2026-60592.references: - https://www.oracle.com/security-alerts/author: Hermes Codex Cyber Intelligencedate: 2026-09-15tags: - attack.initial_access - attack.execution - attack.t1190logsource: category: process_creation product: linuxdetection: selection_parent: ParentImage|endswith: - 'ndb-operator' selection_child: Image|endswith: - 'kill' condition: selection_parent and selection_childlevel: high# Suricata / Network IDS inspection signaturealert tcp any any -> any any (msg:"HERMES - Potential CVE-2026-60592 Exploitation Pattern in MySQL Cluster (Cluster: NDB Operator)"; flow:to_server,established; content:"MySQL"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:60592; rev:1;)# Verify running version of MySQL Cluster (Cluster: NDB Operator)mysql --version || mysqlrouter --version || mysqlsh --version
# Check for abnormal child processes spawned by database daemonsps -ef | grep -E "(ndb-operator|mysql)" | grep -E "(bash|sh|curl|wget|nc)"
# Audit network listening ports for unauthorized exposuress -tlpn | grep -E "()"5. Mitigation & Defense-in-Depth Remediation Steps
Section titled “5. Mitigation & Defense-in-Depth Remediation Steps”-
Apply Official Oracle Vendor Patches: Upgrade MySQL Cluster (Cluster: NDB Operator) to release NDB Operator 8.0.47, 8.4.10, 9.7.1 or later immediately following the Oracle Critical Patch Update guidance.
-
Enforce Network Segmentation & Access Control: Restrict access to port
TCP 9443 / 8080. Under no circumstances should management, routing, or internal shell RPC endpoints be exposed to the public Internet or untrusted subnets. -
Audit Privileges and Role Assignments: Review database user grants (
SUPER,REPLICATION SLAVE,BACKUP_ADMIN). Ensure the principle of least privilege is rigorously applied across application and operator service accounts. -
Rotate Infrastructure Credentials: If compromise or unauthorized access is suspected, immediately rotate database administrative passwords, TLS certificates, and Kubernetes service account tokens.