CVE-2026-75092: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-75092 is a privilege escalation vulnerability in the scan_mysql actor of leapp-upgrade-el9toel10 (part of the leapp-repository package) used during RHEL 9 to RHEL 10 in-place upgrades. The flaw arises because the actor invokes mysqld --validate-config --log-error-verbosity=2 directly as root, bypassing the MySQL systemd unit's User=mysql privilege drop. It was reported on August 17, 2026, publicly disclosed on September 15, 2026, and affects the leapp-repository package (specifically the leapp-upgrade-el9toel10 component) on Red Hat Enterprise Linux systems. The vulnerability carries a CVSS v3.1 base score of 7.3 (High) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-250 (Execution with Unnecessary Privileges): the scan_mysql Leapp actor runs mysqld --validate-config as UID 0 rather than dropping to the mysql service identity as the packaged systemd unit would normally enforce. An attacker with prior OS-level code execution as the mysql user can write a version-2 persisted configuration file (mysqld-auto.cnf) and a malicious shared object (.so) into /var/lib/mysql, a directory owned by the mysql OS user. The persisted configuration can redirect plugin_dir to /var/lib/mysql and set early_plugin_load (or plugin_load/plugin_load_add) so that MySQL calls dlopen() on the attacker-controlled object during configuration validation — before MySQL's runtime-user check and plugin-symbol validation occur. No write access to system plugin paths under /usr is required; SQL-level privileges alone are insufficient — OS-level execution as the mysql service identity is a prerequisite (Red Hat CVE, Red Hat Bugzilla).

When an administrator subsequently runs leapp preupgrade or leapp upgrade, the attacker-controlled shared object executes as UID 0 with a full Linux capability set in an unconfined SELinux domain (unconfined_t), resulting in complete system compromise. This grants full confidentiality, integrity, and availability impact — an attacker can read all data, modify or destroy system files, and disrupt services. The attack effectively converts a lower-privileged mysql service account compromise into unrestricted root access, enabling lateral movement, persistence, and data exfiltration across the entire host (Red Hat CVE, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The attack requires two preconditions: prior OS-level code execution as the mysql service user, and a subsequent administrator-triggered Leapp upgrade workflow (leapp preupgrade or leapp upgrade), making opportunistic exploitation less likely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No EPSS score data was available in the referenced sources at time of disclosure (Red Hat CVE, GitHub Advisory).

1. Gain mysql OS identity: Achieve OS-level code execution as the mysql service user (e.g., via exploitation of a MySQL server vulnerability, misconfigured file permissions, or a web application running as mysql).
2. Plant malicious shared object: Write a malicious ELF shared library (e.g., evil.so) with a constructor function containing the attacker's payload into /var/lib/mysql/, which is writable by the mysql user.
3. Create persisted MySQL configuration: Write or modify /var/lib/mysql/mysqld-auto.cnf (a version-2 persisted configuration file) to set plugin_dir = /var/lib/mysql and early_plugin_load = evil.so (or use plugin_load/plugin_load_add equivalents).
4. Wait for administrator to trigger Leapp: When an administrator runs leapp preupgrade or leapp upgrade as part of the RHEL 9-to-10 upgrade workflow, the scan_mysql actor executes mysqld --validate-config --log-error-verbosity=2 as root.
5. Achieve root code execution: MySQL's plugin loader calls dlopen() on the attacker-controlled evil.so before runtime-user checks occur, executing the ELF constructor as UID 0 in an unconfined SELinux domain (unconfined_t), granting full root access (Red Hat CVE, Red Hat Bugzilla).

• File System: Unexpected or recently modified mysqld-auto.cnf in /var/lib/mysql/ containing plugin_dir, early_plugin_load, plugin_load, or plugin_load_add entries pointing to /var/lib/mysql/; presence of unexpected .so files in /var/lib/mysql/.
• Process: Unusual child processes spawned by mysqld or the Leapp actor process running as UID 0 (e.g., reverse shells, bash, curl, wget, python) during or after a leapp preupgrade/leapp upgrade invocation.
• Logs: Leapp log entries in /var/log/leapp/ showing scan_mysql actor execution followed by unexpected process activity; MySQL error log entries referencing plugin loading from /var/lib/mysql/ during --validate-config runs.
• Network: Unexpected outbound connections from the host originating around the time of a Leapp upgrade workflow execution.

A patch has been committed to the leapp-repository upstream project (commit 3e4cafffc8de1600a66519b326a407f37b665356, PR #1343) that addresses MySQL handling during RHEL 9-to-10 upgrades (GitHub Commit). Red Hat has stated that no configuration-based mitigation meeting their ease-of-use and deployment criteria is currently available (Red Hat CVE). Administrators should apply the patched leapp-repository package once released via Red Hat errata, and in the interim should ensure the mysql service account is not compromised before initiating any Leapp upgrade workflow. As a precautionary measure, inspect /var/lib/mysql/mysqld-auto.cnf for unexpected plugin_dir or plugin-loading directives before running leapp preupgrade or leapp upgrade.

Red Hat classified this as an "Important" privilege escalation flaw and acknowledged the reporter, Christopher Lusk of North Echo Security Research (Red Hat CVE). The vulnerability was tracked internally since August 17, 2026, under an embargo before public disclosure on September 15, 2026 (Red Hat Bugzilla). No significant broader community or social media discussion was identified at the time of disclosure.