Skip to main content

SEC.AUTH.ROLE_NO_PASSWORD_LOCKED — A locked account with nothing behind the lock

  • Category: security
  • Severity: low
  • Level: 0
  • Confidence: deterministic
  • Downtime class: none — the finding is about an account, not about a statement
  • Stability: stable
  • Suites: audit
  • Applies to: MySQL 8.4

Why this is reported at all​

The account cannot be used as it stands, so it is not the thing to fix first — hence low. It is reported rather than skipped because of what the lock actually is: a flag, ALTER USER … ACCOUNT UNLOCK clears it, and it changes nothing about the stored credential. What comes back is an account anyone who knows its name can log into.

A report that stayed silent here would let ACCOUNT LOCK read as a fix for a missing password. It is not a fix; it is a door held shut by a latch somebody can lift.

Bad​

-- Locked, and with nothing behind the lock.
CREATE USER 'legacy_import'@'%' IDENTIFIED WITH caching_sha2_password;
ALTER USER 'legacy_import'@'%' ACCOUNT LOCK;

Good​

-- Give it a password while it is out of use…
ALTER USER 'legacy_import'@'%' IDENTIFIED BY 'a real secret';

-- …or drop it, if nothing needs it any more.
DROP USER 'legacy_import'@'%';

Why a separate rule rather than a lower severity​

Severity in this package is metadata on the rule, so "the same finding, less urgent" cannot be said by one rule reading its subject twice — it has to be a second id. That constraint turns out to be the right shape here anyway: the two findings have different fixes and belong in different places on a work list. Exactly one of the two ever speaks about a given account.

What is not reported​

The same three exclusions as SEC.AUTH.ROLE_NO_PASSWORD: an account whose credential lives outside the database, the engine's own system accounts, and an account whose credential state could not be read — the last one as undetermined, never as an account without a password.

An account deliberately parked and about to be dropped does show up here. That is intended rather than a miss: dropping it is one of the two fixes above.