CVE-2026-75092

A local privilege escalation flaw exists in the scan_mysql actor of leapp-upgrade-el9toel10 (shipped in leapp-repository), which runs mysqld --validate-config directly as root during RHEL 9 to RHEL 10 in-place upgrades instead of using the packaged systemd unit that drops privileges to the mysql user. An attacker who already has OS-level execution as the mysql service identity can plant a crafted persisted configuration (mysqld-auto.cnf) and a malicious shared object in /var/lib/mysql, setting plugin_dir and early_plugin_load so MySQL dlopen()s the attacker-controlled plugin before its runtime-user check. When an administrator later runs the documented Leapp preupgrade or upgrade workflow, the injected code executes as UID 0 with full capabilities in the unconfined_t SELinux domain, yielding complete host compromise. Affected deployments are RHEL 9 systems with MySQL (datadir /var/lib/mysql) that use Leapp for in-place upgrades to RHEL 10; ordinary SQL privileges alone are not sufficient — the attacker must first compromise the mysql OS identity. No public proof of concept exists and no exploitation has been reported (not in CISA KEV).

What to do: Apply Red Hat updates for leapp-repository as soon as a fixed build is released and verify the scan_mysql actor no longer executes mysqld as root. Before any Leapp preupgrade or upgrade run, inspect /var/lib/mysql for unexpected .so files and a mysqld-auto.cnf containing plugin_dir, early_plugin_load, plugin_load, or plugin_load_add entries pointing outside /usr, and audit for signs of compromise of the mysql service account. Additionally, restrict and monitor access to the mysql OS identity, since OS-level execution as mysql is a prerequisite for this attack.