# CVE-2026-46871: Oracle MySQL Shell improper access control in Shell for VS Code

Source: https://junglewise.ai/threats/cve-2026-46871-oracle-mysql-shell-improper-access-control-in-shell-for-vs-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-46871 · Severity: medium · CVSS 6.5 · Published 2026-06-17

A vulnerability exists in the MySQL Shell extension for Visual Studio Code, a tool used by developers and database administrators to manage MySQL databases. An attacker with basic user credentials can exploit this flaw over a network to gain unauthorized access to sensitive database information. This could lead to the exposure of critical business data or a complete breach of all data accessible through the MySQL Shell interface.

Technologies: [Oracle MySQL Shell for VS Code](https://junglewise.ai/threats/technologies/mysql-shell-for-vs-code). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-46871 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46871 being exploited in the wild.

**How severe is CVE-2026-46871?** Medium severity, with a CVSS score of 6.5, published 17 June 2026.

**Which products and versions are affected?** Oracle MySQL Shell (Shell for VS Code) 2026.2.0+9.6.1.

**Is there a fix for CVE-2026-46871?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-46871 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46871?** Check whether you run Oracle MySQL Shell for VS Code. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as an improper access control issue (CWE-284) within the MySQL Shell for VS Code component. It is easily exploitable by a low-privileged attacker with network access via multiple protocols. The flaw does not require user interaction and has a low attack complexity. Successful exploitation allows the attacker to bypass intended security restrictions to achieve high confidentiality impacts, potentially accessing all data the MySQL Shell is authorized to view. The affected version is 2026.2.0+9.6.1.

## Affected products

- Oracle MySQL Shell (Shell for VS Code) 2026.2.0+9.6.1

## Timeline

- 2026-06-17: disclosed
- 2026-06-17: advisory: Oracle Critical Patch Update published

## References

- [https://www.oracle.com/security-alerts/cspujun2026.html](https://www.oracle.com/security-alerts/cspujun2026.html)

## Related threats

- [Oracle MySQL Shell access control bypass in Shell for VS Code](https://junglewise.ai/threats/cve-2026-46870-oracle-mysql-shell-access-control-bypass-in-shell-for-vs-code)
- [Oracle MySQL Shell code injection in Shell for VS Code](https://junglewise.ai/threats/cve-2026-46850-oracle-mysql-shell-code-injection-in-shell-for-vs-code)