CVE-2025-8107: Ob Oceanbase Server

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executing carefully crafted commands. This vulnerability only affects OceanBase tenants in Oracle mode. Tenants in MySQL mode are unaffected.

Affected products

• Ob Oceanbase Server: from 3.2.4, before 3.2.4.8 (fixed in 3.2.4.8); from 4.2.1 x, before 4.2.1.10 (fixed in 4.2.1.10); from 4.2, before 4.2.5 (fixed in 4.2.5); from 4.3.3, before 4.3.3.2 (fixed in 4.3.3.2)

Published 2025-07-24. Last modified 2026-06-17.