CVE-2026-46869: MySQL Shell Data Exposure via CSRF (CVSS 6.5)

Technical summary

This vulnerability stems from a cross-site request forgery (CSRF) weakness (CWE-352) in the MySQL Shell dump and load component. The flaw permits an unauthenticated, network-based attacker to craft a request that, when a user inadvertently engages with it, bypasses authentication controls and exposes MySQL Shell data. The attack surface includes multiple protocols. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects low attack complexity, no privilege requirement, and high confidentiality impact, but requires user interaction and affects only the vulnerable component itself.

Business impact

Organizations using MySQL Shell for database administration and automation face credential theft or exposure of database schemas, connection strings, and operational metadata. If an attacker gains access to stored credentials or sensitive queries, they can pivot to the underlying MySQL databases. The human-interaction requirement limits mass exploitation, but targeted phishing or social engineering against DBAs and DevOps teams could be effective. Data breaches resulting from this vulnerability may trigger compliance obligations (GDPR, HIPAA, PCI-DSS).

Affected systems

MySQL Shell versions 8.4.0 through 8.4.9 and 9.0.0 through 9.7.0 are affected. Organizations must audit their deployments to identify which versions are in use. The vulnerability does not affect the core MySQL server itself, only the Shell administrative tool. Environments where Shell is exposed to untrusted networks or used in shared/multi-tenant scenarios face elevated risk.

Exploitability

While unauthenticated and remotely exploitable, this vulnerability has a moderate bar to weaponization: it requires user interaction (clicking a link, opening a document, or visiting a malicious site). An attacker must craft a request that, when executed by a Shell user, exfiltrates data. The lack of authentication bypass on its own (relying instead on CSRF) means mass exploitation of random targets is unlikely. However, targeted attacks against known DBA or automation engineer users are feasible. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Immediate action: upgrade MySQL Shell to patched versions (verify against the vendor advisory for the exact patched build numbers). Interim mitigations include restricting network access to MySQL Shell instances, disabling unused protocols, using network segmentation to limit Shell's exposure, and educating users to avoid clicking untrusted links or opening suspicious files that might trigger a CSRF request. Consider running Shell in isolated environments or containerized deployments where feasible.

Patch guidance

Consult Oracle's official security advisory for CVE-2026-46869 to identify the specific patched versions for each branch (8.4.x and 9.x). Plan patching based on your current version and deployment model (standalone, containerized, cloud). Test patches in a non-production environment first, as MySQL Shell updates may affect automation scripts or integrated tools. Oracle typically publishes security updates on a published monthly schedule; check for extended support timelines if you are running older minor versions.

Detection guidance

Monitor for unusual access patterns to MySQL Shell configuration files and logs. Look for CSRF-style requests to Shell endpoints (POST requests with unexpected referrer headers or from external origins). Implement HTTP request logging to detect cross-origin requests. Endpoint Detection and Response (EDR) tools can flag suspicious MySQL Shell process spawning or unusual child processes. Database audit logs should capture unexpected data access or exports. Network-based detection should alert on traffic from untrusted origins to MySQL Shell ports.

Why prioritize this

This vulnerability merits prompt but measured attention. The CVSS 6.5 (Medium) score reflects genuine data exposure risk, but the requirement for user interaction prevents it from being automatically exploitable at scale. Prioritize patching for instances exposed to the internet or accessible by developers who may be targeted by phishing. Internal, network-segmented Shell deployments can be patched within standard change windows but should not be deprioritized indefinitely. Organizations with heightened data sensitivity around database metadata should treat this as high-priority.

Risk score, explained

The CVSS 6.5 score balances three factors: (1) network accessibility and low attack complexity (6.5 would be 7.5 without user interaction), (2) complete confidentiality impact (high) against no integrity or availability loss (those would increase the score), and (3) the requirement for user interaction (CWE-352 CSRF characteristic). The Medium severity designation reflects that while data exposure is significant, the attack path is not trivial and requires social engineering or accidental user action.

Frequently asked questions