CVE-2026-46870: MySQL Shell for VS Code Privilege Escalation (CVSS 8.5)

Technical summary

This vulnerability (CWE-284: Improper Access Control) exists in the VS Code extension component of MySQL Shell. The flaw allows an authenticated network attacker to bypass access controls and achieve remote code execution or equivalent system compromise. The CVSS 3.1 score of 8.5 reflects: network-based attack vector, high attack complexity (AC:H), requirement for low-level privileges (PR:L), no user interaction needed, and critically—scope change (S:C), meaning the vulnerability can impact confidentiality, integrity, and availability not only of MySQL Shell but also of other connected systems. The attack chain likely involves leveraging the VS Code extension's network communication layer to escalate permissions or inject malicious operations.

Business impact

Organizations using MySQL Shell for VS Code in production database management environments face significant risk. If an attacker compromises MySQL Shell, they can execute arbitrary operations against connected databases, exfiltrate sensitive data, corrupt database integrity, or disrupt availability. The scope-change attribute is particularly concerning: an attacker gaining control of MySQL Shell may pivot to attack the MySQL servers it manages, potentially affecting entire database infrastructure. For development teams, compromise of this tool can expose credentials, scripts, and database schemas. This vulnerability should be treated as a high-priority security incident given its potential to cascade into broader infrastructure compromise.

Affected systems

Affected: Oracle MySQL Shell version 2026.2.0+9.6.1 and the VS Code extension component. The vulnerability specifically impacts deployments where MySQL Shell is installed as a VS Code extension and used with network access enabled. Organizations running earlier versions or the standalone MySQL Shell CLI (not the VS Code extension) should verify whether they are in scope through Oracle's advisory. Verify the exact version and deployment model against the official Oracle security bulletin.

Exploitability

While the CVSS rating indicates 'difficult to exploit' (AC:H), the barrier to exploitation is primarily technical complexity rather than access—an attacker only needs low-level credentials and network access. Given that VS Code extensions commonly run in developer environments with network connectivity, and given the lack of KEV (Known Exploited Vulnerability) designation, exploitation in the wild is not yet widespread. However, the high attack impact and privilege escalation potential mean this is an attractive target for sophisticated actors. Once an exploit is public or weaponized, exploitation difficulty may decrease as researchers develop reliable attack chains.

Remediation

Immediate action: Apply security patches from Oracle as soon as they are available. Verify the patch version number against Oracle's official security advisory. Until patches are applied, network segmentation is critical—restrict network access to systems running MySQL Shell and limit which databases the tool can reach. Disable the VS Code MySQL Shell extension in non-critical environments if possible. Enforce strong authentication on database systems MySQL Shell connects to, and monitor database access logs for unusual activity originating from Shell sessions. Review and rotate credentials used by MySQL Shell for database connections.

Patch guidance

Wait for Oracle to release a patched version of MySQL Shell (typically published in the Oracle Critical Patch Update cycle or as an out-of-band security release). Check Oracle's MySQL Shell release notes and security advisories at the official Oracle website for version numbers. Once available, prioritize patching systems using the affected version (2026.2.0+9.6.1). Test patches in a non-production environment first, then deploy to development and production in sequence. Update the VS Code extension through the VS Code marketplace or extension settings once Oracle releases an updated build.

Detection guidance

Monitor MySQL Shell process execution and network connections; look for unexpected outbound connections from VS Code or the Shell extension to unusual ports or hosts. Review database audit logs for commands or queries initiated by MySQL Shell sessions, especially privilege escalation attempts, data exfiltration, or schema modifications. Check VS Code and MySQL Shell logs for authentication failures, permission denials, or error messages suggesting exploitation attempts. Network-based detection: flag suspicious network activity from systems running VS Code with MySQL Shell enabled, especially traffic to non-standard ports or to systems outside the trusted database subnet. Correlate VS Code crashes, unexpected restarts, or unusual CPU/memory spikes with potential exploitation.

Why prioritize this

This vulnerability merits immediate priority due to the combination of high CVSS score (8.5), scope change enabling multi-system impact, and the critical nature of database management tools. MySQL Shell is often used by DBAs and developers in trust-heavy environments where compromise can cascade into broader infrastructure attacks. The low privilege requirement means a compromised developer account or low-level service account can be the entry point. Although not yet in the KEV catalog, the technical sophistication suggests active research and eventual weaponization is likely. Organizations managing production databases must patch urgently.

Risk score, explained

The CVSS 3.1 score of 8.5 (HIGH) is driven by: (1) Network attack vector (AV:N)—remote exploitation is possible. (2) High attack complexity (AC:H)—not trivial, but feasible for skilled attackers. (3) Low privilege requirement (PR:L)—only basic credentials needed, common in development environments. (4) No user interaction (UI:N)—automatic exploitation potential. (5) Scope change (S:C)—the most critical factor; compromise extends beyond MySQL Shell to impacted systems like databases, earning HIGH severity despite AC:H. (6) Full impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The combination of easy access (low privileges), significant impact (full compromise), and blast radius (scope change) places this in the top-tier of vulnerabilities.

Frequently asked questions