CVE-2026-86047

7.7High

Published 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.7High

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: Required
Impact: High impact on integrity, availability
Weakness: CWE-89

Impact

A low-privileged authenticated attacker can execute arbitrary SQL when an administrator imports poisoned dump files or executes SHOW CREATE output. The attacker achieves this by creating objects with specially crafted identifiers or values that serialize into injected SQL statements.

Root cause

SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump fail to consistently quote identifiers and values when serializing SQL definitions.

Affected systems

MariaDB server versions from 10.6.1 prior to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H

Fix & remediation

Upgrade to MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2, or later. If patching immediately is not possible, avoid running mariadb-dump, SHOW CREATE SERVER, or SHOW CREATE USER outputs against downstream databases without manually auditing the serialized SQL for injected commands.

shell

$ mariadb --version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-86047