Canonical mysql-k8s-operator up to rev220 Temporary Files credentials storage

Summaryinfo

A vulnerability identified as problematic has been detected in Canonical mysql-k8s-operator up to rev220. The affected element is an unknown function of the component Temporary Files Handler. Performing a manipulation results in credentials storage. This vulnerability is cataloged as CVE-2025-24375. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Canonical mysql-k8s-operator up to rev220. This affects some unknown functionality of the component Temporary Files Handler. The manipulation with an unknown input leads to a credentials storage vulnerability. CWE is classifying the issue as CWE-256. Storing a password in plaintext may result in a system compromise. This is going to have an impact on confidentiality. The summary by CVE is:

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary script file containing the full URI, with user and password. The file can be read by a unprivileged user during the operator runtime, due it being created with read permissions (0x644). On other cases, when calling mysql cli, for one specific case when creating the operator users, the DDL contains said users credentials, which can be leak through the same mechanism of a temporary file. All versions prior to revision 221 for kubernetes and revision 338 for machine operators.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-24375 since 01/20/2025. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability. Applying the patch 7c6b1206fcbc7324b72f413c5e63216e742a71a1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• Canonical

Name

• mysql-k8s-operator

Version

• rev220

License

• open-source

Website

• Product: https://github.com/canonical/mysql-k8s-operator/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion