CVE-2026-22001 Information disclosure in MySQL Server

Low 2.7 Published 21 Apr 2026 Updated 22 Apr 2026

High-privileged attackers can gain unauthorized read access to a subset of MySQL Server data via the Information Schema component.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-22001?

CVE-2026-22001 is a low-severity vulnerability in Oracle Mysql Server, published on 21 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

Weakness: CWE-200

Which versions are affected by CVE-2026-22001?

It affects 1 product.

Products include Oracle Mysql Server.

How do I fix CVE-2026-22001?

Apply the vendor's patch.

Is CVE-2026-22001 being exploited?

There is no known exploitation of CVE-2026-22001 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Oracle Mysql Server vulnerabilities

Sources

Also known as AZL-83163, GHSA-xcgr-x2r4-j9mj, MINI-3v43-47gq-rxwv, MINI-3v8p-gc8x-q7xv, MINI-5r3w-gwf6-rhxm, MINI-9v9g-86mw-w759 and 3 more.