CVE-2026-86047 in MariaDB
Summary
by MITRE • 10/16/2026
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
MariaDB is a widely deployed relational database management system that serves as a community-developed fork of MySQL, offering enhanced features and performance optimizations for enterprise workloads. The vulnerability described herein affects specific versions including MariaDB server releases from 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. This flaw resides within the serialization logic of critical administrative utilities and commands, specifically SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump. These components are responsible for generating SQL statements that represent database objects or configurations, which administrators often use to migrate data, replicate environments, or audit system state. The core technical deficiency is an inconsistency in how identifiers such as table names, column names, usernames, and server definitions are quoted during the serialization process. In many cases, these elements are output without proper escaping or quoting mechanisms that would neutralize special characters like single quotes, double quotes, or backticks, which have syntactic significance within SQL dialects.
The operational impact of this flaw is severe because it enables a low-privileged attacker to execute arbitrary SQL commands through a technique known as SQL injection via metadata poisoning. The attack vector begins when an authenticated user with limited privileges creates database objects, such as tables or users, using crafted identifiers that contain malicious payloads embedded within the name itself. For instance, an attacker might create a table named "users' DROP TABLE orders;--" instead of a benign identifier like "user_data". When this object is referenced in subsequent operations involving SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump, the utility outputs the raw, unquoted malicious string as part of the generated SQL script. If an administrator subsequently copies and executes this output to recreate the environment on another server or restore a backup, the injected statements are parsed and executed by the database engine alongside the intended commands. This allows the attacker to escalate privileges, delete critical data, modify system configurations, or potentially achieve remote code execution depending on the specific SQL dialect features enabled in the MariaDB instance.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-94, which describes Improper Control of Generation of Code ('Code Injection'), and more specifically relates to how input validation fails during output generation for downstream consumption. From a tactical perspective, this maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter, where the attacker leverages legitimate system tools to execute unauthorized commands. The persistence aspect is also notable because once the poisoned SQL script is executed on a target server, the malicious objects or configurations become part of that environment's persistent state, allowing for continued exploitation even after the initial trigger has passed. Defenders must recognize that this is not merely an input validation issue but a failure in output encoding and context-aware quoting during serialization processes.
Mitigation strategies primarily involve upgrading to patched versions immediately, as fixed releases are available at 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. For environments where immediate patching is not feasible due to compatibility constraints or testing requirements, administrators should implement strict input validation policies that prohibit special characters in object names unless absolutely necessary for specific use cases requiring them. Additionally, operational procedures must be reviewed to ensure that SQL scripts generated by dump tools are never executed without thorough manual review and sanitization of the output content. Security teams should also monitor database logs for unusual patterns involving CREATE or DROP statements originating from low-privileged accounts, as these may indicate attempts to exploit this vulnerability before patches are applied. Regular audits of user-defined objects can help identify any pre-existing malicious identifiers that could be leveraged in future exploitation attempts if the system remains unpatched.