CVE-2026-22001
Published: April 24, 2026Last modified: May 5, 2026
Description
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 2.7 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | HIGH |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | LOW |
| Integrity impact | NONE |
| Availability impact | NONE |
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
Notes
https://mariadb.com/docs/server/security/cve/security-vulnerabilities-in-oracle-mysql-that-did-not-exist-in-mariadb
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | mariadb | Not affected (10.6.12-r0) |
| 25 LTS | mariadb | Not affected (11.4.5-r0) | |
| Stream | mariadb | Not affected (10.11.4-r0) |