CVE-2024-21272: mysql-connector-python Connector Takeover Vulnerability
Summary
CVE-2024-21272: MySQL Connector/Python connector takeover vulnerability. Affects mysql-connector-python versions < 9.1.0. Fixed in 9.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MySQL Connector/Python is a popular library that enables Python applications to connect to MySQL databases. It provides a Python interface for MySQL, allowing developers to execute SQL queries, manage database connections, and handle data in a Pythonic way. The library is widely used in web applications, data analysis, and other software that requires database interaction. However, certain versions of this connector are vulnerable to a security flaw that can be exploited by low-privileged attackers.
Vulnerability Detail
The vulnerability in MySQL Connector/Python arises from a flaw that allows low-privileged attackers with network access to compromise the connector. This issue affects versions 9.0.0 and prior, making it possible for attackers to take over the MySQL Connectors. The vulnerability has a CVSS 3.1 Base Score of 7.5, indicating significant impacts on confidentiality, integrity, and availability. Exploiting this vulnerability could lead to unauthorized access and manipulation of database connections.
How To Fix
Latest published version: 26.10.0 as of 23 Oct 2026
pip install --upgrade "mysql-connector-python==26.10.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.1.0
This is the first release that contains the fix.
pip install --upgrade "mysql-connector-python==9.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider restricting network access to the MySQL Connector/Python to trusted sources only. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The MySQL Connector/Python vulnerability (CVE-2024-21272) poses a significant risk to applications using affected versions. It is crucial to update to version 9.1.0 or later to safeguard against potential attacks. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mysql-connector-python →
FAQ
CVE-2024-21272 is a vulnerability in the MySQL Connector/Python that allows low-privileged attackers to take over the connector, affecting versions 9.0.0 and prior.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high level of risk.
If you cannot upgrade immediately, restrict network access to the MySQL Connector/Python to trusted sources to mitigate the risk.
More information can be found in the advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/mysql-connector-python/PYSEC-2026-1685.yaml.
Related vulnerabilities
Recent vulnerabilities recorded for mysql-connector-python.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
