Check ID: cloudsql_instance_mysql_local_infile_flag
Provider: GCP
Service: cloudsql
Severity: HIGH
Categories: vulnerabilities
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL for MySQL instances are evaluated for the local_infile database flag being explicitly set to off, disabling use of LOAD DATA LOCAL. Instances where local_infile is absent or not off are identified.

Risk

With local_infile enabled, clients can send local files via LOAD DATA LOCAL. A stolen credential or SQL injection can coerce clients to leak files and mass-ingest unvetted data, compromising confidentiality and integrity, and aiding lateral movement through secrets imported into the database.

Recommendation

Keep local_infile set to off. Use governed import channels (e.g., controlled object storage imports) and enforce least privilege for bulk-loading. Apply separation of duties between ingestion and admin roles, validate file sources and formats, and monitor high-volume loads. If ever needed, enable only briefly for vetted tasks.

Remediation

gcloud sql instances patch <INSTANCE_NAME> --database-flags=local_infile=off

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_mysql_local_infile_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks