MySQL Privilege Escalation in RHEL Upgrade Process

A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identity can write a version-2 persisted configuration (mysqld-auto.cnf) and a malicious shared object into /var/lib/mysql (a directory owned by mysql). That persisted map can set plugin_dir to /var/lib/mysql and early_plugin_load (or related loader options such as plugin_load / plugin_load_add) so MySQL loads the attacker-controlled object during configuration validation. Plugin loading can reach dlopen() before MySQL’s runtime-user check and before plugin-symbol validation. When an administrator subsequently runs the documented Leapp preupgrade or upgrade workflow, attacker-controlled code can ex

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-75092 exposes a critical privilege escalation vulnerability in the leapp-upgrade-el9toel10 utility used during Red Hat Enterprise Linux 9 to RHEL 10 migrations. The flaw occurs because the scan_mysql actor executes mysqld with root privileges, bypassing the standard MySQL systemd configuration that normally restricts the daemon to the unprivileged mysql user account. This design flaw allows a process running as the mysql OS identity to persist malicious configurations and shared objects, potentially granting attackers code execution with elevated privileges. Organizations performing RHEL upgrades are directly affected, and the vulnerability is particularly dangerous because it targets a routine system administration task that practitioners may not scrutinize for security implications.

Casky's 224 matching security skills leverage Claude's extended reasoning to detect the attack patterns underlying this CVE by mapping to MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify detection opportunities across the attack chain: monitoring for unexpected root-level mysqld process execution outside standard systemd unit invocation, detecting suspicious file writes to mysqld-auto.cnf configuration files, and spotting anomalous shared object loading in MySQL process memory. The platform would surface contextual findings showing how process execution context bypass, unsafe privilege handling, and persistence mechanisms combine to enable exploitation. By correlating these signals with the 754 mapped security skills, practitioners gain visibility into both the technical misconfigurations and the threat actor behaviors that would exploit them during upgrade windows.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75092.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-75092

Casky has 224 skills that investigate the attack patterns behind CVE-2026-75092. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn