CVE-2026-75092

Executive Summary

CVE-2026-75092 is a local privilege escalation flaw in the scan_mysql actor of leapp-upgrade-el9toel10 (shipped via leapp-repository), used during Red Hat Enterprise Linux 9 → 10 in-place upgrades. The actor executes mysqld --validate-config --log-error-verbosity=2 directly as root inside the Leapp actor context, bypassing the packaged MySQL systemd unit that normally runs the daemon as User=mysql. An attacker who already holds OS-level execution as the mysql service identity can plant persisted MySQL configuration (mysqld-auto.cnf) and an attacker-controlled shared object in /var/lib/mysql; when an administrator later runs the documented Leapp pre-upgrade/upgrade workflow, that object is loaded via dlopen() and executes as UID 0 with a full capability set in the unconfined_t SELinux domain. Impact is complete loss of confidentiality, integrity, and availability on the upgraded host (CVSS 7.3), though exploitation requires a pre-existing mysql-identity foothold plus administrator invocation of Leapp — a chained, non-trivial precondition set. EPSS is low (0.00128, ~2.8th percentile) and there is no public PoC, no KEV listing, and no known in-the-wild exploitation.

Technical Analysis

The vulnerability class is execution with unnecessary privileges (CWE-250): a privileged, automated toolchain deliberately drops the service-account boundary that the standard init path enforces.

Normally, the MySQL daemon on RHEL is started by the packaged systemd unit with User=mysql, so any file the daemon reads or writes is constrained by the mysql OS identity. The scan_mysql Leapp actor, however, invokes:

mysqld --validate-config --log-error-verbosity=2

directly as root, inside the Leapp actor execution context, rather than via the packaged systemd unit. Because MySQL's configuration-validation path processes persisted option state and loads plugins (reaching dlopen() before MySQL's runtime-user check and before plugin-symbol validation), the root-run validation step eagerly loads code from a directory the attacker can influence.

The attacker-controlled knobs are:

• Persisted configuration: mysqld-auto.cnf is a version-2 persisted configuration file whose directory is owned by the mysql identity. The attacker sets:
  • plugin_dir → /var/lib/mysql (redirecting the plugin search path away from /usr, which does not need to be writable), and
  • early_plugin_load (or related loader options such as plugin_load / plugin_load_add) to reference the malicious shared object.
• Malicious shared object: a planted .so file in /var/lib/mysql.

Key properties that make this a true boundary bypass rather than a simple misconfiguration:

1. The default system plugin path is irrelevant. The description states explicitly that write access to /usr is not required; redirecting plugin_dir through mysql-owned persisted state is sufficient.
2. Ordering of checks matters. Plugin loading reaches dlopen() before the runtime-user check and before plugin-symbol validation, so the malicious library's initialization executes prior to any guard that would otherwise reject it.
3. Privilege is inherited from the invocation context, not from MySQL's runtime user. Since mysqld was launched as root by the actor, the loaded object runs as root, with a full capability set, in unconfined_t.

Critically, ordinary SQL privileges are not a sufficient start point — even a highly privileged SQL account cannot trigger this. The start point is OS-level code execution as the mysql service identity, combined with a later administrator-initiated Leapp preupgrade/upgrade run.

The available data does not specify which exact MySQL option file the actor reads first, which Leapp command line flags invoke scan_mysql, or the version of mysqld shipped in the affected RHEL release; those implementation details are not available and should not be assumed.

Exploitation Scenarios

This is a chained local privilege escalation requiring two distinct capabilities at two distinct times. The attack chain below is derived strictly from the NVD description; no public PoC is available, and no specific code patterns are invented.

1. Reconnaissance / pre-condition acquisition. The attacker must first obtain OS-level execution as the mysql service identity on the target RHEL 9 system. Typical ways this occurs are out-of-band for this CVE (e.g., a prior web-application or SQL-layer compromise that yields command execution in the mysql context) — the CVE description itself does not define how the attacker reaches the mysql identity, only that this is required. The attacker then determines that the host is on the RHEL 9 → 10 upgrade path and that Leapp (leapp-upgrade-el9toel10) is present, meaning an administrator will plausibly run the preupgrade workflow.

2. Triggering the flaw class — planting persisted state. Operating as mysql, the attacker writes two artifacts into the mysql-owned directory /var/lib/mysql:

   • the version-2 persisted configuration file mysqld-auto.cnf, containing a plugin_dir entry pointing at /var/lib/mysql and an early/plugin-load directive (early_plugin_load, or plugin_load / plugin_load_add) that names the attacker's shared object; and
   • the malicious shared object itself (a compiled library implementing attacker-chosen initialization logic). No write access to /usr is needed; the redirect is entirely through mysql-owned persisted state.

3. Execution method — root-run config validation loads the library. When the administrator later runs the documented Leapp preupgrade/upgrade workflow, the scan_mysql actor runs mysqld --validate-config --log-error-verbosity=2 as root, outside the systemd unit's User=mysql confinement. MySQL's configuration validation loads the configured plugin through dlopen(); the description states this occurs before the runtime-user check and before plugin-symbol validation, so the attacker's object is mapped and executed in that root-owned process.

4. Post-exploitation impact. Attacker-controlled code executes as UID 0 with a full capability set in the unconfined_t SELinux domain. With unconfined_t and full capabilities, the executing code is effectively outside the SELinux confinement that would normally restrict the mysql service, enabling wholesale system compromise — persistence, credential access, lateral movement, and disabling of defenses — consistent with the CVSS impact subscores (C:H/I:H/A:H). The CVSS vector reflects the required user interaction (UI:R, the administrator running Leapp) and local attack vector (AV:L) with low privileges (PR:L, the mysql OS identity).

Impact Assessment

Business impact. Successful exploitation yields root-level code execution on a production database host at the moment of a planned OS upgrade, i.e., during a change window when monitoring is often relaxed and many services are being touched. Because the executing code runs as UID 0 with a full capability set in unconfined_t, the blast radius is the entire upgraded host: MySQL data (a high-value target in its own right), any credentials or keys readable by root, and any trust relationships the host participates in. On a database server, confidentiality and integrity of regulated data (financial, PII, healthcare) are directly at risk, and the attacker inherits whatever downstream access the DB host has.

Affected systems. Any RHEL host undergoing a RHEL 9 → RHEL 10 in-place upgrade via leapp-upgrade-el9toel10 where a local attacker can act as the mysql identity before the administrator runs the upgrade. The precondition (OS execution as mysql) narrows the reachable population, and the need for a later admin-invoked Leapp run adds a timing dependency — which is why the attacker population is constrained but the impact when it lands is total.

Blast radius and scoring. CVSS 3.1 score 7.3 (High), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H:

• AV:L (Local) — requires local positioning, not remote reachability. No network exposure; this is not wormable.
• AC:L (Low) — no unusual race/conditions; the persisted-config redirect reliably triggers on the next Leapp run.
• PR:L (Low) — requires low privileges (the mysql OS identity), not root. Note SQL privileges alone are explicitly insufficient.
• UI:R (Required) — an administrator must run the documented Leapp workflow.
• S:U (Unchanged) — impact is scoped to the vulnerable component's authority (the actor context), not a security-scope change.
• C:H/I:H/A:H — total confidentiality, integrity, and availability impact once code runs as root.

Likelihood. Low-to-moderate: EPSS 0.00128 (~2.8th percentile), no CISA KEV listing, no public PoC, no Nuclei template, no exploit code in the intelligence feed. The elevated CVSS is driven by impact severity and required privileges, not by observed exploitation. Realistic targeting is a motivated, positioned adversary who already holds a mysql-identity foothold and knows an upgrade is scheduled.

Detection Guidance

Because the trigger is a legitimate administrative action (leapp running mysqld) combined with abnormal persisted state, detection should focus on file-system mutations of MySQL option files / plugin directories and process-lineage anomalies (root-owned mysqld --validate-config spawning or loading from /var/lib/mysql). The rules below are defensive heuristics; tune paths and binaries to your environment.

Sigma Rule

title: Potential CVE-2026-75092 - MySQL Persisted Config Tampering Prior to Leapp Upgrade
id: 8f3a1c2e-7509-4d92-a1b7-000000000092
status: experimental
description: Detects writes to MySQL persisted configuration (mysqld-auto.cnf) or creation of
  shared objects in the mysql data directory, which may precede privilege escalation via the
  Leapp scan_mysql actor running mysqld as root (CVE-2026-75092).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75092
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: file_event
  product: linux
detection:
  selection_autocnf:
    TargetFilename|endswith:
      - '/mysqld-auto.cnf'
  selection_so_in_datadir:
    TargetFilename|endswith:
      - '.so'
    TargetFilename|contains:
      - '/var/lib/mysql/'
  filter_legit_upgrade:
    Image|contains:
      - '/leapp'
  condition: (selection_autocnf or selection_so_in_datadir) and not filter_legit_upgrade
falsepositives:
  - Legitimate MySQL configuration management writes to mysqld-auto.cnf
  - MySQL plugin installation by an administrator during maintenance
level: high
tags:
  - attack.privilege_escalation
  - attack.t1548
  - attack.t1574.002
  - cve.2026.75092

YARA Rule

rule CVE_2026_75092_Malicious_MySQL_Plugin
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects potentially malicious shared objects planted in MySQL data dir for CVE-2026-75092"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75092"
        date = "2026-01-01"
        cve = "CVE-2026-75092"

    strings:
        // ELF shared object magic
        $elf = { 7F 45 4C 46 }
        // MySQL plugin loader option strings referenced by persisted config abuse
        $opt1 = "early_plugin_load" ascii wide nocase
        $opt2 = "plugin_load_add" ascii wide nocase
        $opt3 = "plugin_dir" ascii wide nocase
        // common execution primitives seen in dropped root code
        $exec1 = "execl" ascii
        $exec2 = "system" ascii
        $exec3 = "/bin/sh" ascii

    condition:
        $elf at 0 and
        ( 2 of ($opt*) ) and
        ( $exec1 or $exec2 or $exec3 )
}

Note: The YARA rule above targets files that combine ELF structure, MySQL loader-option strings, and shell-execution primitives. Tune to reduce false positives against legitimate MySQL plugins, which will also match $elf; the option-string and exec-primitive conditions raise specificity.

Suricata IDS Rule

This CVE is a local privilege escalation with no network attack surface, so there is no reliable packet-level signature for the exploit itself. A best-effort rule can flag suspicious writes to mysqld-auto.cnf if a file-integrity/network-monitoring bridge is in place; the rule below is a placeholder that should be adapted or omitted if no such bridge exists.

alert tcp $HOME_NET any -> $HOME_NET [3306] (msg:"CVE-2026-75092 possible MySQL persisted-config tampering staging (heuristic)"; flow:to_server,established; content:"mysqld-auto.cnf"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; sid:202675092; rev:1;)

Deployment caveat: LPE-only vulnerabilities generally produce no exploitable network traffic. Prioritize host-based file-integrity, Sigma, EQL/SPL, and auditd/Wazuh telemetry over Suricata for this CVE.

Elastic Detection

process where event.type == "start" and
  process.name == "mysqld" and
  process.args : "*--validate-config*" and
  process.parent.name : ("leapp*", "python*") and
  // flag root execution of the validation step during an upgrade window
  process.user.id == "0"

Broader hunting variant also correlating file events:

sequence by host.id with maxspan=30m
  [ file where file.name : "mysqld-auto.cnf" and file.path : "/var/lib/mysql/*" ]
  [ process where process.name == "mysqld" and process.args : "*--validate-config*" and process.user.id == "0" ]

Splunk SPL Query

index=linux (source="/var/log/audit/audit.log" OR source="XmlWinEventLog:*")
| eval path='name'."".'file'  -- or use host-based file-integrity fields
| search (path="/var/lib/mysql/mysqld-auto.cnf" OR path="/var/lib/mysql/*.so"
          OR (process="mysqld" AND process_args="*--validate-config*") )
| eval victim_host=host
| stats count min(_time) as first_seen max(_time) as last_seen
        values(process) as proc values(process_args) as args
        values(user) as user by victim_host
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Alternative file-integrity-focused variant:

index=osquery OR index=file_integrity
| search path="/var/lib/mysql/mysqld-auto.cnf" OR (path="/var/lib/mysql/*" AND path="*.so")
| stats count values(action) as actions by host, path, user
| where count > 0

Wazuh OSSEC Rule

<group name="cve_2026_75092,linux,privilege_escalation,">
  <rule id="2026750" level="3">
    <if_sid>550</if_sid>
    <field name="file">/var/lib/mysql/mysqld-auto.cnf</field>
    <description>CVE-2026-75092: MySQL persisted config file (mysqld-auto.cnf) modified</description>
  </rule>

  <rule id="2026751" level="10">
    <if_group>syscheck</if_group>
    <field name="file">/var/lib/mysql/mysqld-auto.cnf</field>
    <description>CVE-2026-75092: Suspicious modification of MySQL persisted config - possible LPE staging</description>
  </rule>

  <rule id="2026752" level="12">
    <if_group>syscheck</if_group>
    <field name="file">/var/lib/mysql/*.so</field>
    <description>CVE-2026-75092: Shared object created in MySQL data directory - possible malicious plugin</description>
  </rule>

  <rule id="2026753" level="12">
    <if_sid>5902</if_sid>
    <match>--validate-config</match>
    <description>CVE-2026-75092: mysqld run with --validate-config (possible Leapp scan_mysql root execution)</description>
  </rule>
</group>

Note: Rule IDs are illustrative and should be placed in a custom local rules file; ensure Syscheck/FIM is monitoring /var/lib/mysql and that command-line telemetry (auditd execve) is forwarded for the --validate-config rule.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED). A single source (NVD metadata) indicates a patch is available, but no vendor fix version string, advisory, or independent confirmation was provided in the intelligence feed. Treat patch availability as unverified and validate against Red Hat's official errata before relying on it.

1. Immediate mitigations (no patch required):

   • Lock down /var/lib/mysql. Because the flaw hinges on the mysql identity's ability to write mysqld-auto.cnf and plant a shared object there, restrict filesystem write access to that directory to the minimum necessary and audit its contents for unexpected .so files and plugin_dir / plugin_load / early_plugin_load entries.
   • Review persisted configuration. Inspect mysqld-auto.cnf for a plugin_dir pointing at /var/lib/mysql, or any early_plugin_load / plugin_load / plugin_load_add directives that were not authorized. Remove unauthorized directives and objects.
   • Eliminate standing mysql-identity code execution. The attack cannot proceed without OS-level execution as the mysql service identity. Harden whatever path grants that (web apps, SQL-to-OS escalation primitives, overly permissive file permissions on the data dir), as this is the true precondition.
   • Control the Leapp timing window. Only trusted administrators should run the documented Leapp preupgrade/upgrade workflow, and it should be run from a known-good state after confirming no unauthorized changes to MySQL persisted state. Where feasible, run upgrade workflows under enhanced monitoring.
   • Be aware that SQL privileges are not the vector — this does not mean relaxing DB account restrictions; it means OS-context controls are the relevant lever here.

2. Patch / upgrade steps:

   • Verify the claimed patch. Check Red Hat's official security advisories and errata for leapp-repository / leapp-upgrade-el9toel10 for CVE-2026-75092; confirm the fixed package version (not provided in this feed) before remediation.
   • Update the affected leapp-repository / leapp-upgrade-el9toel10 package to the vendor-fixed version on every host in the RHEL 9 → 10 upgrade pipeline, and re-run the preupgrade workflow only after the fix is in place.
   • Re-validate /var/lib/mysql integrity post-upgrade.

3. Long-term hardening:

   • Design principle: privileged upgrade actors should not invoke service daemons as root in a way that bypasses the service's own user-drop. Advocate for vendor fixes that preserve the User=mysql boundary, or run validation under a confined context.
   • SELinux posture: this flaw yields unconfined_t; keep enforcement enabled and pursue narrower domains for upgrade tooling where feasible.
   • File Integrity Monitoring: continuously monitor /var/lib/mysql/mysqld-auto.cnf and any .so in the MySQL data directory (see detection rules).
   • Change management: incorporate a pre-upgrade integrity check of MySQL persisted configuration into standard RHEL in-place upgrade runbooks.

References

• NVD — CVE-2026-75092: https://nvd.nist.gov/vuln/detail/CVE-2026-75092
• Red Hat Security Advisories / Errata (search for CVE-2026-75092 across leapp-repository / leapp-upgrade-el9toel10): https://access.redhat.com/security/security-updates/
• Red Hat RHEL in-place upgrade documentation (Leapp preupgrade/upgrade workflow): https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/
• MITRE ATT&CK — T1548 Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/
• MITRE ATT&CK — T1574.002 Hijack Execution Flow: DLL Side-Loading (mapped to malicious shared-object load): https://attack.mitre.org/techniques/T1574/002/

Exploitation status: No public PoC, no exploit code, no Nuclei template, and no CISA KEV listing were present in the provided intelligence feed. EPSS is 0.00128 (~2.8th percentile), indicating low predicted exploitation activity at time of writing. No named threat actor campaigns or in-the-wild exploitation evidence are associated with this CVE in the available data. Patch status is unconfirmed (2/4, single-source claim); validate against official Red Hat errata before relying on a fix.