A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identity can write a version-2 persisted configuration (mysqld-auto.cnf) and a malicious shared object int

CVE-2026-75092 is a privilege escalation vulnerability in the scan_mysql actor of leapp-upgrade-el9toel10, used during RHEL 9 to RHEL 10 upgrades. The actor runs mysqld --validate-config directly as root, bypassing the normal MySQL systemd unit that restricts execution to the mysql user. An attacker with OS-level access as the mysql identity can write a malicious shared object and a persisted configuration (mysqld-auto.cnf) into /var/lib/mysql, redirecting plugin_dir and using early_plugin_load to force MySQL to load the attacker-controlled library via dlopen() before privilege and symbol checks occur. When an administrator later invokes the Leapp preupgrade or upgrade workflow, the malicious code executes as UID 0 with a full capability set in an unconfined SELinux domain (unconfined_t). Exploitation requires prior OS-level compromise of the mysql service identity, not just SQL-level privileges. The vulnerability affects the leapp-repository project and has been addressed via a commit and pull request on GitHub.