If the format stays the same with the single space between the key-value parts, the keys start with -- and there is XX in the replacement, you could match the pattern and capture the key value parts in group 1.
\bmysql (--\w+=\w+(?: --\w+=\w+)*)
regex demo
In the replacement, split on a space and replace the last part after the = with XX
const s = "mysql --user=USER_NAME --host=DB_HOST --database=SCHEMA";
const regex = /\bmysql (--[^\s=]+=[^\s=]+(?: --[^\s=]+=[^\s=]+)*)/;
const result = s.replace(
regex,
(_, g1) => "mysql " + g1
.split(' ')
.map(s => s.split('=')[0] + "=XX")
.join(' ')
);
console.log(result);
An example using an infinite quantifier in the lookbehind
(note that if this is for security, replacing each char with a single X can give away a hint about the length of the string)
(?<=\bmysql(?: --[^\s=]+=[^\s=]+)* --[^\s=]+=)[^\s=]+
Regex demo
const s = "mysql --user=USER_NAME --host=DB_HOST --database=SCHEMA";
const regex = /(?<=\bmysql(?: --[^\s=]+=[^\s=]+)* --[^\s=]+=[^\s=]*)[^\s=]/g;
const result = s.replace(regex, "X");
console.log(result);
$3....Xyou need to have?