🔐 CVE Alert

CVE-2026-86047

HIGH 7.7

MariaDB: Insufficient quoting in mariadb-dump and SHOW commands

CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
0th

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CWE CWE-89
Vendor mariadb
Product server
Published Oct 16, 2026
Stay Ahead of the Next One

Get instant alerts for mariadb server

Be the first to know when new high vulnerabilities affecting mariadb server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High

Affected Versions

MariaDB / server
>= 10.6.1, < 10.6.28 >= 10.11.1, < 10.11.19 >= 11.4.1, < 11.4.13 >= 11.8.1, < 11.8.9 >= 12.3.1, < 12.3.3 >= 13.0.1, < 13.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p github.com: https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52 github.com: https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5 github.com: https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a github.com: https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513 github.com: https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b github.com: https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 github.com: https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 github.com: https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 github.com: https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 github.com: https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 github.com: https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 jira.mariadb.org: https://jira.mariadb.org/browse/MDEV-39776 jira.mariadb.org: https://jira.mariadb.org/browse/MDEV-39818 jira.mariadb.org: https://jira.mariadb.org/browse/MDEV-40308 jira.mariadb.org: https://jira.mariadb.org/browse/MDEV-40311 jira.mariadb.org: https://jira.mariadb.org/browse/MDEV-40312