MySQL Bugs: #73814: MySQL creates a new username when logging in from a remote host

Bug #73814	MySQL creates a new username when logging in from a remote host
Submitted:	5 Sep 2014 8:35	Modified:	13 Jan 2015 22:56
Reporter:	Phillip Macdonald	Email Updates:
Status:	Can't repeat	Impact on me:	None
Category:	MySQL Server	Severity:	S2 (Serious)
Version:	5.6.13	OS:	Windows
Assigned to:		CPU Architecture:	Any

Description:
When I log in to the server with another machine, it will create a duplicate account with the username and no password and no permissions. MYSQL Workbench will then log me into this account and I will be unable to perform any tasks because I have no permissions.

How to repeat:
1. Create an account with ALTER, ALTER ROUTINE, CREATE, CREATE ROUTINE, CREATE TEMPORARY TABLES, CREATE VIEW, DELETE, DROP, EVENT, FILE, GRANT OPTION, INDEX. INSERT, LOCK TABLES, PROCESS, RELOAD, SELECT, SHOW DATABASES, SHOW VIEW, SHUTDOWN, SUPER, TRIGGER and UPDATE.

2. Log in through a different account on a local network (with a WIndows machine)

3. A new account will be created with the Windows machine's hostname and no permissions or password.

Suggested fix:
A workaround to stop you not getting any permissions is to create an account with 192.168.% with the same permissions and MySQL Workbench will log you in as this account instead of the one with no permissions. I do not have a fix though.

This is now preventing me from accessing the server normally.

Do you really see a new user/hostname combination being added to the mysql.user table with this?

Or are you just hitting the "anonymous" test account created by mysql_install_db that has full access to the "test" database but nothing else? In that case http://dev.mysql.com/doc/refman/5.5/en/default-privileges.html should help ...

I believe it is a new account because it appears as my username and then the host name of the new machine. It does have no permissions though, and then when you log in on the new machine it binds to this new account.

The account has no permissions and no password and appears as a totally separate entry in mysql.user.

Not enough information was provided for us to be able to handle this bug. Please re-read the instructions at http://bugs.mysql.com/how-to-report.php

If you can provide more information, feel free to add it to this bug and change the status back to 'Open'.

Thank you for your interest in MySQL.