CVE-2026-46870: MySQL Shell Auth Bypass Vulnerability

CVE-2026-46870 Overview

CVE-2026-46870 affects the Oracle MySQL Shell product, specifically the Shell for VS Code component. The supported version 2026.2.0+9.6.1 is affected. The flaw allows a low-privileged attacker with network access via multiple protocols to compromise MySQL Shell. Although the vulnerability resides in MySQL Shell, successful exploitation can produce a scope change that impacts additional products. Oracle disclosed the issue in its June 2026 Critical Patch Update Security Alert. The weakness is categorized under [CWE-284] Improper Access Control.

Critical Impact
Successful exploitation results in full takeover of MySQL Shell with high impact to confidentiality, integrity, and availability, and may compromise additional components beyond MySQL Shell.

Affected Products

Oracle MySQL Shell 2026.2.0+9.6.1
MySQL Shell for Visual Studio Code component
Downstream products reachable through scope change

Discovery Timeline

2026-06-17 - CVE-2026-46870 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-46870

Vulnerability Analysis

The vulnerability resides in the MySQL Shell for VS Code component of Oracle MySQL Shell. The flaw permits a low-privileged attacker operating over the network to manipulate the Shell extension and obtain control of the MySQL Shell process. The attack vector spans multiple protocols, which broadens reachability across developer workstations and CI environments.

The scope change indicates the exploited component can affect resources beyond its own security authority. An attacker can therefore pivot from MySQL Shell into other connected products or workloads. The advisory reports high impact across confidentiality, integrity, and availability.

Exploitation is rated as difficult, requiring specific conditions to succeed. No user interaction is needed once the prerequisites are met. No public proof-of-concept code is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The weakness maps to [CWE-284] Improper Access Control. The Shell for VS Code component does not adequately restrict actions that a low-privileged authenticated actor can request, allowing operations that should be denied. The control gap enables manipulation of MySQL Shell state and execution context.

Attack Vector

The attacker requires network reachability to the MySQL Shell instance and low-level privileges within the environment. After establishing the prerequisite access, the attacker issues crafted requests over one of the supported protocols. Successful chains result in MySQL Shell takeover and, due to the scope change, influence over connected components. Refer to the Oracle Security Alert for protocol and configuration specifics.

Detection Methods for CVE-2026-46870

Indicators of Compromise

Unexpected MySQL Shell sessions originating from developer endpoints running the VS Code extension.
Anomalous outbound connections from the mysqlsh process to untrusted hosts.
Modifications to MySQL Shell configuration files or extension state outside change windows.

Detection Strategies

Monitor process execution of mysqlsh and child processes spawned by the VS Code extension host.
Correlate authentication events for low-privileged accounts followed by privileged MySQL operations.
Inspect network telemetry for atypical protocol usage targeting MySQL Shell endpoints.

Monitoring Recommendations

Enable verbose logging on MySQL Shell and forward to a centralized log platform for retention.
Alert on installation, update, or sideload events for the MySQL Shell VS Code extension.
Track CPU, memory, and connection counts on hosts running MySQL Shell to flag abuse patterns.

How to Mitigate CVE-2026-46870

Immediate Actions Required

Apply the fixes referenced in the Oracle June 2026 Critical Patch Update Security Alert.
Inventory all developer workstations and servers running MySQL Shell 2026.2.0+9.6.1.
Restrict network exposure of MySQL Shell to trusted management segments only.
Audit low-privileged accounts that can interact with MySQL Shell and remove unnecessary access.

Patch Information

Oracle published remediation guidance in the June 2026 Critical Patch Update Security Alert. Administrators should upgrade MySQL Shell to the fixed release identified in the alert and update the Shell for VS Code extension across all developer endpoints. Verify the patched version is loaded by running mysqlsh --version after deployment.

Workarounds

Disable the MySQL Shell for VS Code extension on systems that do not require it.
Enforce network access controls so MySQL Shell endpoints accept connections only from trusted sources.
Require strong authentication and limit privilege assignments for any account that can reach MySQL Shell.

bash

# Configuration example
# Verify installed MySQL Shell version after patching
mysqlsh --version

# Disable the VS Code extension on managed endpoints if patch deployment is delayed
code --uninstall-extension Oracle.mysql-shell-for-vs-code