---
id: CVE-2024-21272
aliases:
  - GHSA-hgjp-83m4-h4fj
  - PYSEC-2026-1685
title: MySQL Connector/Python connector takeover vulnerability
summary: MySQL Connector/Python connector takeover vulnerability
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: mysql-connector-python
product: mysql-connector-python
ecosystem: pip
affected:
  - mysql-connector-python < 9.1.0
patched:
  - mysql-connector-python 9.1.0
published: '2024-10-15'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:19.802969095Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hgjp-83m4-h4fj'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-21272'
  - url: >-
      https://github.com/mysql/mysql-connector-python/commit/e6b927af06e8a85bd3754f602df96a5592b4558c
  - url: 'https://github.com/mysql/mysql-connector-python'
  - url: 'https://www.oracle.com/security-alerts/cpuoct2024.html'
tags:
  - osv
  - pip
epss: 0.00513
epssPercentile: 0.42758
ingestedAt: '2026-07-08T18:25:50.226Z'
---

## Overview

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).  Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

## Affected packages

- `mysql-connector-python < 9.1.0`

## Remediation

Upgrade to a patched release:

- `mysql-connector-python 9.1.0`