All vulnerabilities
CVE-2026-86047GHSA-wxr3-wm3p-7w6p

server: MariaDB: Insufficient quoting in mariadb-dump and SHOW commands

MariaDB serverDatabases
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.6.28Also 10.11.19, 11.4.13 and 3 moreGitHub
Published16 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Text from CVE List

Affected versions 7

  • serveraffected: >= 10.6.1, < 10.6.28CVE List
  • serveraffected: >= 10.11.1, < 10.11.19CVE List
  • serveraffected: >= 11.4.1, < 11.4.13CVE List
  • serveraffected: >= 11.8.1, < 11.8.9CVE List
  • serveraffected: >= 12.3.1, < 12.3.3CVE List
  • serveraffected: >= 13.0.1, < 13.0.2CVE List
  • server10.6.1-10.6.27, 10.11.1-10.11.18, 11.4.1-11.4.12, 11.8.1-11.8.8, 12.3.1-12.3.2, 13.0.1GitHub

References 17