Leapp RHEL 9 to 10 upgrade: scan_mysql runs mysqld as root, letting mysql-owned state load code as UID 0

Impact

The scan_mysql actor runs mysqld --validate-config directly as root instead of through the packaged systemd unit that drops to User=mysql. A process already holding the mysql OS identity can drop a malicious shared object plus a version-2 mysqld-auto.cnf into /var/lib/mysql, which it owns, and point plugin_dir and early_plugin_load at them; plugin loading reaches dlopen() before MySQL's runtime-user check. The next time an administrator runs the documented Leapp preupgrade or upgrade workflow, that object executes as UID 0 with a full capability set in unconfined_t. For a fleet this matters where a MySQL instance sits beside the GPU workload on a node or on a management host that is due for a RHEL 9 to 10 upgrade: a service-account compromise becomes host root at the moment of the upgrade, and SQL privileges alone are not enough - OS-level execution as mysql is required.

Who can reach it

Local attacker who already has code execution as the mysql service identity on a host running the RHEL 9 to 10 Leapp upgrade, plus a later administrator invocation of the Leapp preupgrade or upgrade workflow. Highly privileged SQL accounts alone do not suffice.

What to do

Apply the Red Hat errata for leapp-repository (RHSA-2026:67608 / 67609) on any host before running a RHEL 9 to 10 upgrade; it is a package update to the upgrade tooling, so no reboot beyond the one the upgrade itself performs. If an upgrade is imminent and the host runs MySQL, inspect /var/lib/mysql for an unexpected mysqld-auto.cnf or shared objects before starting.

References

Related entries

• zbus_polkit: caller-supplied UID is silently discarded, leaving polkit authorization open to a PID-reuse raceCVE-2026-78422 · zbus_polkit Rust crate (Subject::new_for_owner UID encoding)High
• OpenZFS: ioctl checks accept unprivileged user-namespace capabilities, granting local pool adminCVE-2026-79619 · OpenZFS on Linux (/dev/zfs ioctl privilege checks vs. unprivileged user namespaces)High
• Linux kernel eBPF: syncookie helpers read sk_protocol on mini-sockets without a fullsock checkCVE-2026-80738 · Linux kernel eBPF (bpf_tcp_gen_syncookie / bpf_tcp_check_syncookie helpers)High
• Xen on AMD - x86 HVM pagetable height update: AMD HVM guest OS users can trigger a data-structure access during aCVE-2019-19577 · Xen on AMD - x86 HVM pagetable height updateHigh
• VMware vCenter Server: admin on the appliance shell can run arbitrary OS commandsCVE-2024-22274 · VMware vCenter Server Appliance (appliance shell)High
• IBM Spectrum Scale kernel module: An unauthenticated local trigger takes down the Spectrum Scale kernel module and withCVE-2020-4411 · IBM Spectrum Scale kernel moduleHigh