Port 3306 (MySQL) is the default port for MySQL database connections. Internet-exposed instances are commonly targeted for password attacks, misconfiguration checks and exploitation of unpatched servers. Restrict access to trusted hosts, use strong credentials and encrypted connections, and review logs for repeated authentication failures and unexpected connection sources.
What Port 3306 Means in Practice
Port 3306 is the standard entry point for MySQL traffic, so it is less a feature than an exposure surface. When that port is reachable beyond trusted networks, it becomes part of the database trust boundary and must be treated as an externally visible service, not an internal convenience.
That distinction matters because database ports are often scanned, guessed against, and probed for weak authentication or sloppy deployment settings. A simple port opening can turn into a persistent access path if the instance, account policy, or network controls are weak.
Why Internet Exposure Creates Security Pressure
MySQL services exposed on a public address are attractive targets because they combine a well-known port with a high-value backend. Attackers do not need to “discover” the protocol first; they can immediately test for default access patterns, password attacks, and misconfiguration. The Network Ports and Protocols Security Guide places port 3306 alongside other commonly exposed services that require explicit restriction and hardening.
The risk is amplified when exposure is paired with permissive host rules, reused credentials, or unencrypted sessions. In that state, the port is not just a transport detail, it becomes a direct route to data, administrative functions, and potentially lateral movement inside the environment.
How Organisations Check Exposure and Reduce Attack Surface
Exposure review starts with inventory and reachability, not with the database itself. Teams should know where MySQL is deployed, whether it is bound to internal networks only, and whether any security groups, firewall rules, load balancers, or NAT paths make it reachable from untrusted sources.
That review should be paired with vendor guidance and protocol authority. IANA is the canonical reference for port and protocol registration, which helps confirm why 3306 is treated as the default MySQL service port rather than an arbitrary application choice.
For operational hardening, organisations should narrow the allowed source ranges, enforce strong authentication, require encrypted client connections where supported, and monitor for repeated failed logins or unexpected origins. These controls reduce the chance that a known service port becomes an open invitation to brute force or opportunistic exploitation.
Detection, Compromise Review, and Identity Impact
Because port 3306 often fronts a credentialed service, compromise review should include both network evidence and account evidence. Repeated authentication failures, new client IPs, unusual query volumes, or connections outside normal administrative windows can indicate probing or active abuse. If a server is successfully accessed, post-incident review should focus on whether database credentials, application secrets, or downstream service accounts were exposed through that instance.
When MySQL access is handled as a service-to-service trust path, the relevant question is not only whether the port is open, but whether the credential behind it still deserves its privileges. The OWASP Non-Human Identity Top 10 is useful here because database accounts, API credentials, and other machine-used secrets can become long-lived access paths if they are not rotated, scoped, and reviewed after exposure.
If compromise is suspected, organisations should assume the database endpoint may have been used to enumerate data, test credentials, or pivot into adjacent systems. That makes log review, session review, and secret rotation as important as network containment.
Risk and Threat Considerations
Port 3306 is risky when it is exposed to the internet because it advertises a live database service to attackers who routinely probe for weak authentication and vulnerable deployments. The main danger is not the port number itself, but the combination of reachability, trust, and stored data behind it.
Failure mechanism: Public reachability allows automated scanning, password spraying, and configuration testing against MySQL instances, then turns any successful login into direct database access or a foothold for further compromise.
Impact: Exposure can lead to unauthorized data access, account abuse, service disruption, and post-compromise use of the database account or connected secrets to expand access elsewhere.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Port 3306 exposure depends on controlling who can authenticate to MySQL. |
| Recommendation — Restrict database access to approved accounts and remove unused login paths. | ||
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | Port exposure is governed by enforced network flow restrictions and source allowlisting. |
| IA-5 — Authenticator Management | MySQL exposure is dangerous when passwords, keys, or tokens are weak or reused. | |
| SC-8 — Transmission Confidentiality and Integrity | MySQL traffic on exposed port 3306 should be protected in transit. | |
| Recommendation — Enforce source restrictions so only approved hosts can reach MySQL. Rotate and protect database authenticators and remove stale credentials. Require encrypted database sessions to protect credentials and data in transit. | ||
Practitioner Guidance
Why practitioners should care: Treat port 3306 as an access decision, not a networking detail. If MySQL does not need broad reachability, default to private exposure and allow only the smallest set of trusted sources that genuinely need it.
What to watch for: Unexpected connection sources, repeated failed authentications, and MySQL services that are reachable from the public internet without a clearly justified business need are all signs that the exposure model needs review.
Practitioner takeaway: Secure MySQL by shrinking who can reach 3306, hardening how they authenticate, and verifying after every exposure event that no credential or session path was left behind.