A flaw in the MySQL Shell Core Client can be triggered by an attacker who, based on the description, appears to require high privileges on the host and can reach the Shell over the network. Although difficult to exploit, the vulnerability permits the attacker to obtain unauthorized access to any data that the Shell can reach, effectively compromising confidentiality of all MySQL data exposed through these interfaces. The description also notes that the vulnerability may affect additional products because the scope can change when the Shell is used as a gateway.

Oracle Corporation’s MySQL Shell is the affected product. Vulnerable releases include 8.0.0‑8.0.45, 8.4.0‑8.4.8 and 9.0.0‑9.6.0.

The CVSS v3.1 base score of 5.8 reflects a moderate confidentiality impact. The EPSS score of less than 1% indicates an estimated probability of exploitation that is very low, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation may require high host privileges and network connectivity to the Shell, so restricting external access and enforcing strong authentication can reduce the likelihood of a successful attack. The noted scope change means that if the Shell serves as a gateway, other components may also be impacted.