CVE-2026-46850: Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code)

Synopsis

This is a critical-severity vulnerability in the Shell for VS Code component of Oracle MySQL Shell (version 2026.2.0+9.6.1). An attacker with a low-privilege account can reach the affected service over the network via HTTP and exploit it without any victim interaction, triggering a full takeover of MySQL Shell with scope change effects on other products running in the same environment. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment Oracle ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected MySQL Shell service over the network via HTTP; local or physical access is not required.

• AuthenticationRequired

  Any low-privilege account is sufficient; no administrative or elevated credentials are needed beyond a basic authenticated session.

• Victim interactionNot required

  No user action, click, or social-engineering step is needed; the attacker can exploit the service directly.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other environmental preconditions.

Blast Radius

• A successful attacker achieves full takeover of MySQL Shell, including the ability to read all data accessible to the shell process such as database credentials, query results, and session tokens.
• The attacker can modify or delete persisted data and configurations managed through the shell, including connected database schemas.
• The shell process can be crashed or made unavailable, disrupting developer and operational workflows that depend on it.
• Because the CVSS scope is changed, other products or services co-located in the same environment may also be compromised through lateral movement from the shell process.