Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-75092
StatePUBLISHED
Assignerredhat
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-15 09:16:43 UTC
Updated2026-09-16 19:42:43 UTC
DescriptionA privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identity can write a version-2 persisted configuration (mysqld-auto.cnf) and a malicious shared object into /var/lib/mysql (a directory owned by mysql). That persisted map can set plugin_dir to /var/lib/mysql and early_plugin_load (or related loader options such as plugin_load / plugin_load_add) so MySQL loads the attacker-controlled object during configuration validation. Plugin loading can reach dlopen() before MySQL’s runtime-user check and before plugin-symbol validation. When an administrator subsequently runs the documented Leapp preupgrade or upgrade workflow, attacker-controlled code can execute as UID 0 with a full capability set in an unconfined SELinux domain (unconfined_t). The attack does not require write access to the default system plugin path under /usr; redirecting plugin_dir via mysql-owned persisted state is sufficient. Ordinary SQL privileges alone (including highly privileged SQL accounts) are not a sufficient startpoint — OS-level execution as the mysql service identity is required, plus later administrator invocation of Leapp.

Risk And Classification

Primary CVSS: v3.1 7.3 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.001280000 probability, percentile 0.028430000 (date 2026-09-16)

Problem Types: CWE-250 | CWE-250 Execution with Unnecessary Privileges

VersionSourceTypeScoreSeverityVector
3.1[email protected]Secondary7.3HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
3.1CNACVSS7.3HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Red Hat Red Hat Enterprise Linux 9 unaffected 0:0.24.0-1.el9_8.1 * rpm Not specified
CNA Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support unaffected 0:0.22.0-1.el9_6.2 * rpm Not specified
CNA Red Hat Red Hat Enterprise Linux 8 Not specified Not specified
CNA Red Hat Red Hat OpenStack Platform 17.1 Not specified Not specified

References

ReferenceSourceLinkTags
github.com/oamg/leapp-repository [email protected] github.com
github.com/oamg/leapp-repository/commit/3e4cafffc8de1600a66519b326a407f3... [email protected] github.com
access.redhat.com/errata/RHSA-2026:67608 [email protected] access.redhat.com
access.redhat.com/errata/RHSA-2026:67609 [email protected] access.redhat.com
bugzilla.redhat.com/show_bug.cgi [email protected] bugzilla.redhat.com
access.redhat.com/security/cve/CVE-2026-75092 [email protected] access.redhat.com
github.com/oamg/leapp-repository/pull/1343 [email protected] github.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue. (en)

Additional Advisory Data

SourceTimeEvent
CNA2026-08-17T16:32:16.614ZReported to Red Hat.
CNA2026-09-15T00:00:00.000ZMade public.

Workarounds

CNA: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report