Bug #91652 user can delete records from mysql.servers
Submitted: 16 Jul 2018 7:19 Modified: 16 Aug 2018 13:10
Reporter: yghmgl yang Email Updates:
Status: No Feedback Impact on me:
None 
Category:MySQL Server Severity:S3 (Non-critical)
Version:5.7 OS:Any
Assigned to: CPU Architecture:Any

[16 Jul 2018 7:19] yghmgl yang
Description:
Users should not have permission to delete the records of mysql.servers

How to repeat:
create server SERVER_TEST_01
foreign data wrapper mysql options(
host 'host',
database 'database',
user 'user',
password 'password',
socket 'socket',
owner 'owner',
port 0
);

select * from mysql.servers;

DELETE FROM mysql.servers where Server_name = 'SERVER_TEST_01';

select * from mysql.servers;

create server SERVER_TEST_01
foreign data wrapper mysql options(
host 'host',
database 'database',
user 'user',
password 'password',
socket 'socket',
owner 'owner',
port 0
);
[16 Jul 2018 13:10] MySQL Verification Team
Hello yghmgl yang,

Thank you for the report.
Imho, quoting from our manual page "The CREATE SERVER statement creates a new row in the servers table in the mysql database".. 
So, any privileged user with appropriate privileges on mysql.servers table or any other system tables can delete rows which is in similar line with other system table, for example users table etc. Could you please elaborate on why you want to prevent "delete" on mysql.servers? Thank you!

Regards,
Umesh
[17 Aug 2018 1:00] Bugs System
No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".