Ensure No Excessive `SUPER` Privilege Grants

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

SELECT User, Host FROM mysql.user WHERE Super_priv = 'Y'; Confirm only TDSQL system accounts (such as the necessary tdsqlsys_kp_new) hold the SUPER privilege.

How it is fixed

Fix method: Guidance or infrastructure patch

Revoke the SUPER privilege from unnecessary users: REVOKE SUPER ON *.* FROM 'username'@'host'; In MySQL 8.0, use fine-grained dynamic privileges (such as SYSTEM_VARIABLES_ADMIN, CONNECTION_ADMIN) instead of SUPER.