Snapshot is using user '{}' but it likely doesn't have prope

Error message

Snapshot is using user '{}' but it likely doesn't have proper privileges. If tables are missing or are empty, ensure connector is configured with the correct MySQL user and/or ensure that the MySQL user has the required privileges.

What it means

This warning is logged by Debezium's SnapshotReader when the SHOW GRANTS query run against the MySQL user configured for the connector returned an empty result set. It means the connector cannot verify that the snapshot user holds the SELECT/RELOAD/LOCK TABLES privileges needed to read the captured tables, so tables may come back missing or empty during snapshotting.

Source

Thrown at seatunnel-connectors-v2/connector-cdc/connector-cdc-mysql/src/main/java/io/debezium/connector/mysql/legacy/SnapshotReader.java:1149

                        }
                    });
        } catch (SQLException e) {
            logger.info("Cannot determine MySql server version", e);
        }
    }

    private void logRolesForCurrentUser(JdbcConnection mysql) {
        try {
            List<String> grants = new ArrayList<>();
            mysql.query(
                    "SHOW GRANTS FOR CURRENT_USER",
                    rs -> {
                        while (rs.next()) {
                            grants.add(rs.getString(1));
                        }
                    });
            if (grants.isEmpty()) {
                logger.warn(
                        "Snapshot is using user '{}' but it likely doesn't have proper privileges. "
                                + "If tables are missing or are empty, ensure connector is configured with the correct MySQL user "
                                + "and/or ensure that the MySQL user has the required privileges.",
                        mysql.username());
            } else {
                logger.info(
                        "Snapshot is using user '{}' with these MySQL grants:", mysql.username());
                grants.forEach(grant -> logger.info("\t{}", grant));
            }
        } catch (SQLException e) {
            logger.info("Cannot determine the privileges for '{}' ", mysql.username(), e);
        }
    }

    /**
     * Utility method to replace the offset and the source in the given record with the latest. This
     * is used on the last record produced during the snapshot.
     *

View on GitHub (pinned to cf67b549a7)

Solutions

Verify the username in the CDC source config matches the actual MySQL user: SELECT user, host FROM mysql.user;
Grant the required privileges: GRANT SELECT, RELOAD, SHOW DATABASES, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'user'@'%'; then FLUSH PRIVILEGES;
Check the grant host pattern matches the address the connector connects from (e.g. 'user'@'%' vs 'user'@'10.0.%').
Confirm you are connecting to the intended MySQL server (host/port in config) with mysql -u user -p -h host and run SHOW GRANTS;

Example fix

// before
url = "jdbc:mysql://localhost:3306/mydb"
username = "seatunnel"
// after
-- on MySQL server
CREATE USER 'seatunnel'@'%' IDENTIFIED BY '***';
GRANT SELECT, RELOAD, SHOW DATABASES, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'seatunnel'@'%';
FLUSH PRIVILEGES;

Defensive patterns

Strategy: validation

Validate before calling

// Before running the CDC job, verify the user's grants:
// mysql -h host -u user -p -e "SHOW GRANTS FOR CURRENT_USER();"
// Ensure output includes SELECT, RELOAD, REPLICATION SLAVE, REPLICATION CLIENT.

Prevention

Run SHOW GRANTS FOR 'user'@'host' before starting snapshot jobs
Grant SELECT, RELOAD, SHOW DATABASES, REPLICATION SLAVE, REPLICATION CLIENT on *.* to the CDC user
Match the grant host pattern to the connector's source IP or use '%'
Smoke-test credentials with a plain mysql client against the same host the job uses

When it happens

Trigger: SnapshotReader.execute() runs 'SHOW GRANTS FOR <user>@<host>' (or SHOW GRANTS) via a prepared query with a row handler that accumulates grants into a list; if that list is empty (grants.isEmpty()) the warning fires, logging mysql.username().

Common situations: Typo in the username in the seatunnel CDC config; user created without any privileges; SHOW GRANTS returns no rows because the connecting host doesn't match any grant's host pattern; user lacks rights to see its own grants; connecting to the wrong MySQL instance.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/f1a72b35246003e3. Report an issue: GitHub.