During a RHEL 9 to RHEL 10 upgrade, the leapp‑upgrade‑el9toel10 scan_mysql actor executes mysqld --validate-config as the root user. An attacker who compromises the mysql OS identity can create a persisted configuration file and a malicious shared object in /var/lib/mysql, which is owned by the mysql user. By redirecting plugin_dir to /var/lib/mysql and specifying plugin_load options, MySQL loads the attacker’s object during configuration validation before its runtime user check and before plugin-symbol validation. This allows the attacker to execute arbitrary code with UID 0, full capabilities and in an unconfined SELinux domain, effectively achieving full system compromise. The vulnerability requires both an OS‑level compromise of the mysql service identity and the later execution of the Leapp upgrade workflow; ordinary SQL privileges alone are insufficient.

Affected systems include Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, and Red Hat OpenStack Platform 17.1. Version information for the affected packages is not specified beyond the product line; users should ensure they are running the pre‑upgrade or upgrade packages referenced in the Red Hat errata RHSA‑2026:67608 and RHSA‑2026:67609.

The CVSS score of 7.3 indicates a high severity vulnerability. The EPSS score of less than 1 % suggests that, as of the latest data, exploitation is considered unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack requires only a compromised mysql service identity—an attainable target on systems with misconfigured or vulnerable MySQL installations—and the trigger is the normal Leapp upgrade process, which most administrators will run when updating their RHEL environment.