CVE-2026-75092: RHEL Leapp Upgrade Privilege Escalation

CVE-2026-75092 Overview

CVE-2026-75092 is a local privilege escalation vulnerability in the scan_mysql actor of leapp-upgrade-el9toel10, provided by the leapp-repository package. During RHEL 9 to RHEL 10 in-place upgrades, the actor invokes mysqld --validate-config --log-error-verbosity=2 directly as root, bypassing the packaged MySQL systemd unit that normally drops privileges to User=mysql. An attacker who has already compromised the mysql OS identity can plant a malicious shared object and a version-2 persisted configuration in /var/lib/mysql. When an administrator later runs the Leapp preupgrade or upgrade workflow, the attacker-controlled code executes as UID 0 in the unconfined SELinux domain [CWE-250].

Critical Impact
Attacker-controlled code loaded during MySQL configuration validation executes as root with a full capability set in unconfined_t, converting a mysql-identity foothold into full system compromise.

Affected Products

Red Hat Enterprise Linux 9 (leapp-repository providing leapp-upgrade-el9toel10)
Systems performing in-place upgrade from RHEL 9 to RHEL 10 with MySQL server installed
Red Hat Enterprise Linux 10 upgrade tooling addressed in RHSA-2026:67608 and RHSA-2026:67609

Discovery Timeline

2026-09-15 - CVE-2026-75092 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-75092

Vulnerability Analysis

The scan_mysql actor runs mysqld --validate-config as root during the Facts phase of the Leapp upgrade workflow. The upstream MySQL systemd unit normally starts mysqld under User=mysql, but the Leapp actor invokes the binary directly and does not drop privileges. Because MySQL processes its persisted configuration map (mysqld-auto.cnf) and executes plugin loading before the runtime-user check and before plugin-symbol validation, an attacker who controls the on-disk state under /var/lib/mysql can force dlopen() of an arbitrary shared object while mysqld still runs as UID 0.

Root Cause

The root cause is a Category [CWE-250] Execution with Unnecessary Privileges flaw. The scan_mysql actor invokes mysqld outside the packaged systemd unit and therefore skips the User=mysql drop. It trusts data under /var/lib/mysql, which is writable by the mysql account, as input to a root-privileged validation step.

Attack Vector

Exploitation requires OS-level code execution as the mysql service identity. SQL-only access, even with elevated SQL privileges, is not sufficient. The attacker writes a crafted mysqld-auto.cnf that sets plugin_dir to /var/lib/mysql and populates early_plugin_load, plugin_load, or plugin_load_add with a malicious shared object placed in the same directory. When an administrator later runs leapp preupgrade or leapp upgrade, the scan_mysql actor executes mysqld --validate-config as root, dlopen() loads the attacker's object, and its constructor runs with a full capability set inside unconfined_t.

python

# Patched actor logic - repos/system_upgrade/el9toel10/actors/mysql/scanmysql/actor.py
from leapp.actors import Actor
from leapp.libraries.actor import scanmysql
from leapp.models import DistributionSignedRPM, MySQLConfiguration
from leapp.tags import FactsPhaseTag, IPUWorkflowTag


class ScanMySQL(Actor):
    """
    Actor checking for presence of MySQL installation.

    If MySQL server is found it will check whether current configuration is not
    deprecated and produce all options and arguments that are in use and are
    deprecated. These are removed in newer version of MySQL that is present in
    RHEL10.
    """
    name = 'scan_mysql'
    consumes = (DistributionSignedRPM,)
    produces = (MySQLConfiguration,)
    tags = (FactsPhaseTag, IPUWorkflowTag)

    def process(self) -> None:
        self.produce(scanmysql.check_status())

Source: GitHub Leapp Commit 3e4caff. The patched actor produces a MySQLConfiguration model consumed by a separate MySQLCheck actor that reports to the administrator, replacing the previous flow that invoked mysqld as root for configuration validation.

Detection Methods for CVE-2026-75092

Indicators of Compromise

Presence of a mysqld-auto.cnf file under /var/lib/mysql containing plugin_dir, early_plugin_load, plugin_load, or plugin_load_add values pointing at /var/lib/mysql.
Unexpected .so shared object files owned by the mysql user in /var/lib/mysql.
mysqld process invocations with --validate-config running as UID 0 rather than under User=mysql.
Child processes of leapp executing in the unconfined_t SELinux domain that spawn unexpected binaries.

Detection Strategies

Audit /var/lib/mysql for shared objects and for mysqld-auto.cnf entries that redirect plugin loading paths.
Enable Linux audit rules on execve of /usr/libexec/mysqld or /usr/sbin/mysqld with --validate-config and alert when auid=0 and uid=0 co-occur.
Correlate leapp preupgrade or leapp upgrade invocations with subsequent dlopen() events from mysqld targeting non-standard paths.

Monitoring Recommendations

Baseline the contents of /var/lib/mysql on hosts running MySQL and alert on new .so files or new persisted configuration entries.
Monitor for out-of-band writes to mysqld-auto.cnf by processes other than mysqld running under User=mysql.
Track administrator execution of Leapp workflows and review host state prior to upgrade windows.

How to Mitigate CVE-2026-75092

Immediate Actions Required

Apply the updated leapp-repository packages from Red Hat Security Advisory RHSA-2026:67608 and Red Hat Security Advisory RHSA-2026:67609 before running any RHEL 9 to RHEL 10 upgrade.
Inspect /var/lib/mysql on every affected host for unauthorized mysqld-auto.cnf entries and unexpected shared objects prior to invoking leapp preupgrade.
Investigate any host where the mysql account may already have been compromised; the patch does not remediate an existing foothold.

Patch Information

Red Hat has shipped fixed leapp-repository packages through RHSA-2026:67608 and RHSA-2026:67609. Additional analysis is available in the Red Hat CVE Analysis and Red Hat Bug Report #2517499. The upstream fix is tracked in GitHub Pull Request #1343 and delivered by commit 3e4caff, which replaces the root-privileged mysqld --validate-config call with a reporting actor that consumes a MySQLConfiguration model.

Workarounds

Do not run leapp preupgrade or leapp upgrade on hosts with MySQL server installed until the patched leapp-repository is in place.
Temporarily remove or archive any unexpected mysqld-auto.cnf and shared objects under /var/lib/mysql after confirming they are not legitimate.
Restrict interactive access to the mysql OS account and monitor for lateral movement into that identity.

bash

# Verify the patched leapp-repository is installed before upgrading
rpm -q leapp-repository leapp-upgrade-el9toel10

# Inspect for suspicious persisted MySQL configuration and shared objects
ls -la /var/lib/mysql/mysqld-auto.cnf 2>/dev/null
find /var/lib/mysql -maxdepth 2 -name '*.so' -ls
grep -Ei 'plugin_dir|early_plugin_load|plugin_load' /var/lib/mysql/mysqld-auto.cnf 2>/dev/null