CVE-2025-21540: Oracle MySQL Server Auth Bypass Flaw

CVE-2025-21540 Overview

CVE-2025-21540 is an authorization flaw in the Oracle MySQL Server Server: Security: Privileges component. The vulnerability affects MySQL Server versions 8.0.40 and prior, 8.4.3 and prior, and 9.1.0 and prior. A low-privileged attacker with network access via multiple protocols can exploit this weakness to compromise MySQL Server. Successful exploitation grants unauthorized update, insert, or delete access to some MySQL Server data and unauthorized read access to a subset of that data. Oracle published the vulnerability in its January 2025 Critical Patch Update advisory. The flaw is classified under [CWE-863: Incorrect Authorization].

Critical Impact
Authenticated attackers can bypass MySQL Server authorization controls to read, modify, insert, or delete database records they should not be able to access.

Affected Products

Oracle MySQL Server 8.0.40 and prior
Oracle MySQL Server 8.4.3 and prior
Oracle MySQL Server 9.1.0 and prior

Discovery Timeline

2025-01-21 - CVE-2025-21540 published to NVD following Oracle's January 2025 Critical Patch Update
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-21540

Vulnerability Analysis

The vulnerability resides in the Server: Security: Privileges component of Oracle MySQL Server. This subsystem enforces access controls over database objects and operations. The flaw permits a low-privileged authenticated user to perform actions outside the boundaries of their granted privileges. According to Oracle's advisory, the issue impacts confidentiality and integrity but not availability. Attackers can reach the vulnerable code path over the network using multiple supported MySQL protocols, including the standard MySQL client/server protocol and X Protocol. The Exploit Prediction Scoring System (EPSS) currently ranks the probability of exploitation in the wild as low.

Root Cause

The root cause is improper authorization [CWE-863] within the privilege enforcement logic. The MySQL Server privilege checker does not correctly validate the requesting user's effective rights against the target operation or object. As a result, a session holding minimal privileges can perform DML operations (SELECT, INSERT, UPDATE, DELETE) on data that should remain inaccessible based on the granted GRANT configuration.

Attack Vector

Exploitation requires valid credentials on the target MySQL Server instance, even at the lowest privilege tier. The attacker connects over the network using any supported MySQL protocol and issues crafted SQL statements that exercise the flawed authorization path. No user interaction is required, attack complexity is low, and the attack does not change the security scope. The result is unauthorized read access to a subset of server-accessible data and unauthorized write access (insert, update, or delete) to some server-accessible data. No verified public proof-of-concept code is currently associated with this CVE. See the Oracle Security Alert January 2025 for vendor-supplied technical context.

Detection Methods for CVE-2025-21540

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE statements in MySQL general or binary logs originating from low-privileged accounts.
Authenticated sessions from service or application accounts accessing tables or schemas outside their documented scope.
Anomalous use of multiple MySQL protocols (classic protocol and X Protocol) by the same low-privileged user within a short time window.

Detection Strategies

Enable the MySQL general query log or audit log plugin and review DML statements executed by accounts with minimal GRANT privileges.
Correlate binary log events against expected application query patterns to surface privilege boundary violations.
Baseline read and write activity per database user and alert on deviations involving tables the account does not normally touch.

Monitoring Recommendations

Forward MySQL audit and binary logs to a centralized logging or SIEM platform for retention and correlation.
Track failed and successful authentication events from network-reachable MySQL endpoints to identify credential reuse or brute-force activity that could precede exploitation.
Monitor for outbound data volume spikes from MySQL hosts that may indicate unauthorized read access at scale.

How to Mitigate CVE-2025-21540

Immediate Actions Required

Apply Oracle's January 2025 Critical Patch Update to all MySQL Server instances running 8.0.40, 8.4.3, 9.1.0, or earlier.
Inventory all MySQL accounts and remove unused or stale credentials that could be leveraged by an authenticated attacker.
Review GRANT assignments and enforce least privilege on every application and administrative account.

Patch Information

Oracle released fixes as part of the January 2025 Critical Patch Update. Patched releases are MySQL Server 8.0.41, 8.4.4, and 9.2.0 or later. NetApp shipped corresponding updates for bundled MySQL components, documented in the NetApp Security Advisory NTAP-20250131-0004. Refer to the Oracle Security Alert January 2025 for the complete patch matrix.

Workarounds

Restrict network access to MySQL Server using firewall rules so that only trusted application hosts can reach TCP port 3306 and the X Protocol port 33060.
Disable or remove low-privileged accounts that do not require remote network access until patching can be completed.
Enforce TLS for client connections and require strong authentication plugins such as caching_sha2_password to limit credential exposure.

bash

# Verify installed MySQL Server version and upgrade if affected
mysql --version

# Example: enable the audit log plugin to capture DML activity
mysql -uroot -p -e "INSTALL PLUGIN audit_log SONAME 'audit_log.so';"

# Example: restrict MySQL listener to trusted interface in my.cnf
# [mysqld]
# bind-address = 10.0.0.10
# require_secure_transport = ON