CVE-2026-46870: Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code)

Synopsis

This is a network-exploitable privilege escalation and full-takeover vulnerability in the Shell for VS Code component of Oracle MySQL Shell version 2026.2.0+9.6.1. A low-privileged attacker with network access can exploit the flaw over multiple protocols, though reliable exploitation requires overcoming elevated complexity conditions. Successful exploitation results in a complete takeover of MySQL Shell, with high impact to confidentiality, integrity, and availability, and the scope change means adjacent products or containers can also be affected. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MySQL Shell service over the network via one or more supported protocols; no local or physical access is assumed.

• AuthenticationRequired

  A low-privilege account on the target system or service is sufficient; anonymous or unauthenticated access alone does not satisfy this condition.

• Victim interactionNot required

  No user interaction is needed; the attacker can execute the attack entirely without involving another person.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must meet specific environmental conditions, such as race conditions or particular configuration states, before the attack reliably succeeds.

Blast Radius

• A successful attacker gains full read access to all data accessible by MySQL Shell, including database credentials, query results, and stored connection profiles.
• The attacker can modify or delete database contents, configuration files, and shell session state, corrupting persisted data.
• The attacker can crash or hang the MySQL Shell process, disrupting developer and pipeline workflows that depend on it.
• Because the CVSS scope is changed, exploitation can pivot to affect other products or services running in the same environment, such as connected database servers or VS Code extension host processes.