MySQL Shell CVE-2026-46871

Exploitation requires Oracle MySQL Shell version 2026.2.0+9.6.1 with the Shell for VS Code component installed, operational, and reachable over the network. The attacker must satisfy a low-privilege credential requirement (PR:L per CVSS vector), meaning some form of initial authentication is a prerequisite - fully unauthenticated exploitation against anonymous endpoints is not confirmed by available data. The ENISA 'Authentication Bypass' tag suggests these low-level credentials may be trivially obtained or themselves circumventable, but this is inferred from the intelligence tag rather than confirmed by Oracle's advisory text. No user interaction is required (UI:N), and no specific non-default configuration is documented as a necessary precondition beyond the extension being installed and active. Exploitation is strictly limited to data confidentiality loss - no write access or denial-of-service capability is established. Environments where the VS Code extension is absent, disabled, or where the extension's network interface is firewalled to trusted hosts are not exposed to this vulnerability.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-accessible, low-complexity attack requiring only low privileges (PR:L), producing high confidentiality impact with no integrity or availability loss. The combination of AV:N/AC:L/UI:N makes this straightforward to exploit for any attacker who can satisfy the PR:L credential threshold. Notably, the ENISA 'Authentication Bypass' tag introduces ambiguity: if the low-privilege barrier is itself circumventable, the effective exploitation threshold may be lower than the raw CVSS PR:L score implies - a signal that defenders should not dismiss. No EPSS score was provided in the available intelligence, leaving exploitation probability unquantified; this is a gap in the current data set. There is no CISA KEV listing and no public exploit code, reducing immediate urgency relative to actively exploited issues. However, the unchanged scope (S:U) limits blast radius to MySQL Shell's own data footprint, and the absence of integrity or availability impact means this is a targeted data theft risk rather than a system compromise vector. Organizations exposing the VS Code extension's interface across untrusted network segments should treat this as a genuine medium-high operational priority despite the moderate base score.

An attacker with low-level network credentials connects to the MySQL Shell VS Code extension's exposed network interface and sends crafted protocol requests that exploit insufficient authorization logic within the component. By bypassing the data-access restrictions that should constrain low-privileged callers, the attacker reads the complete contents of all databases and schema objects accessible to the MySQL Shell session. No publicly available exploit code has been identified, but the low attack complexity (AC:L) and absence of required user interaction mean a functional exploit could be developed with moderate effort by a skilled attacker.