MySQL Shell CVE-2026-34318

Exploitation requires the attacker to already hold a high-privileged MySQL Shell account (PR:H) with network access to the target instance via at least one of MySQL Shell's supported protocols; the 'multiple protocols' phrasing suggests the flaw is in shared Core Client code rather than protocol-specific logic. High attack complexity (AC:H) implies additional non-default conditions must align - these could include specific Shell configuration states, session parameters, timing of the attack relative to Shell operations, or a particular sequence of commands that triggers the disclosure path; exact conditions are not specified in available data and must be confirmed with Oracle. The scope change (S:C) means the attack targets systems or data accessible from the Shell session beyond MySQL Shell itself, which may require the attacker's session to have connectivity to those downstream resources. What limits exploitation: the primary barrier is the requirement for a pre-authenticated, high-privileged account - unauthenticated remote attackers cannot initiate exploitation. The SSVC 'not automatable' rating confirms this cannot be scripted for opportunistic mass targeting. There is no required user interaction (UI:N). The unresolved 'Authentication Bypass' tag from VulDB may indicate a secondary authentication control is bypassed once initial access is established, which could slightly lower the effective privilege bar - verify with Oracle.

The CVSS 3.1 base score of 5.8 (Medium) reflects the tension between a high confidentiality impact with scope change and the substantial exploitation barriers of high attack complexity (AC:H) and high privilege requirements (PR:H). In practice, these prerequisites significantly constrain real-world risk: an attacker must already hold a high-privileged MySQL Shell account and must satisfy non-trivial complexity conditions before achieving exploitation. EPSS at 0.03% (8th percentile) is consistent with no observed exploitation activity, and SSVC independently rates exploitation as none, automatable as no, and technical impact as only partial - all signals converging on a low-urgency finding. No CISA KEV listing exists. One unresolved tension: the VulDB tag 'Authentication Bypass' conflicts with the PR:H metric; if the vulnerability itself bypasses a secondary authentication mechanism rather than the primary login, real-world privilege requirements may be lower than CVSS implies - this should be verified against the Oracle advisory. This is not a mass-exploitation risk but warrants patching on standard vulnerability management timelines, prioritizing environments where MySQL Shell is used by multiple principals or connects to high-value downstream systems.

A rogue insider or attacker who has compromised a high-privileged database administrator account uses MySQL Shell's network connectivity across one of its supported protocols - JavaScript, Python, or SQL mode - to trigger the CWE-200 information disclosure in the Core Client, under specific high-complexity conditions such as a targeted query pattern or timing requirement. By exploiting the scope change, the attacker pivots to access critical data in systems connected to or reachable from the MySQL Shell session, exfiltrating complete schema contents beyond what the immediate Shell context should expose. No public proof-of-concept has been identified, and the high attack complexity means opportunistic exploitation is unlikely without targeted, environment-specific knowledge.