I have configured my MySQL Database to require passwords on all users, even root from the machine itself.

Now I discovered that there are empty Users in my Database

Reproduce: mysql -u root -p and then use mysql; & select * from user;

It gives me 2 entries, one with "localhost" and user <empty> and one with the machine's hostname and <empty>.

Now I tried to access the account with mysql -u ' ' (yes it's correct, leave a space between the ' things) and I log in without a password. The user can "only" see information_schema and test, the two databases created by default. He does not has access to mysql or any other custom created databases.

I already changed the Password of this user to something I won't tell you

mysql -u root -p
use mysql;
UPDATE mysql.user SET Password=PASSWORD('thisisasecretpassword') WHERE USER='root';

Now my Questions:

  • Is any MySQL Server vulnerable for an attack with this entry?

  • Could an attacker break out of this account or the two default databases?

  • Should I password-protect those Users or can I delete them? Are They required for some MySQL-internal things?


2 Answers 2


Those are anonymous users and, as such, don't need passwords. They are created by default on all installations. I'm not sure why it's done this way.

You can either set a password for them or remove them. From https://dev.mysql.com/doc/refman/5.6/en/default-privileges.html:

If you want to prevent clients from connecting as anonymous users without a password, you should either assign a password to each anonymous account or else remove the accounts.

Seems to be a duplicate of this one: MySQL 5.5.16 allows anonymous connections

  • Thank you for the Link, didn't find it myself ;) By the way, are there more things like that (which I need to take care of) for MySQL?
    – v3nd3tta
    Nov 28, 2012 at 13:02

Use mysql_secure_installation to remove anonymous users, test databases and also prevent remote connect using root user.


Not the answer you're looking for? Browse other questions tagged or ask your own question.