Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2026-107823: MariaDB versions allow privilege increase with crafted username
CVE-2026-107823 · published 26 days ago
Summary
Versions of MariaDB and related MySQL packages listed above may let a user who can create accounts and views add a specially crafted username that tricks the system into granting higher rights. This can let an attacker gain extra database privileges. Upgrade to the patched versions or apply the vendor’s update to stop the issue.
What to do
- Update debian mariadb to version 1:11.8.9+ds-1.
- Update mariadb to version 1:10.11.19-0+deb12u1.aikido.11.
- Update rootio-mariadb to version 1:10.11.19-0+deb12u1.aikido.11.
- Update mariadb to version 1:11.8.6-0+deb13u1.aikido.9.
- Update rootio-mariadb to version 1:11.8.6-0+deb13u1.aikido.9.
- Update mariadb to version 1:11.8.6-0+deb13u1.aikido.10.
- Update rootio-mariadb to version 1:11.8.6-0+deb13u1.aikido.10.
- Update mariadb to version 1:10.11.19-0+deb12u1.aikido.12.
- Update rootio-mariadb to version 1:10.11.19-0+deb12u1.aikido.12.
- Update bellsoft mariadb to version 10.6.28-r0.
- Update bellsoft mariadb to version 11.4.13-r0.
- Update bellsoft mariadb to version 11.8.9-r0.
- Update mariadb to version 13.0.2.
- Update mariadb-min to version 13.0.2.
- Update mysql-client to version 13.0.2.
- Update mariadb to version 1:11.8.6-0+deb13u1.aikido.11.
- Update rootio-mariadb to version 1:11.8.6-0+deb13u1.aikido.11.
- Update mariadb to version 1:10.11.19-0+deb12u1.aikido.13.
- Update rootio-mariadb to version 1:10.11.19-0+deb12u1.aikido.13.
- Update mariadb to version 1:11.8.6-0+deb13u1.aikido.12.
- Update rootio-mariadb to version 1:11.8.6-0+deb13u1.aikido.12.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mariadb | server | >= 10.6.1, < 10.6.28 |
| Debian:12 | debian | mariadb | All versions |
| Debian:14 | debian | mariadb |
< 1:11.8.9+ds-1 Fix: upgrade to 1:11.8.9+ds-1
|
| Ubuntu:14.04:LTS | canonical | mysql-5.5 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | mysql-5.7 | All versions |
| Ubuntu:16.04:LTS | canonical | mariadb-10.0 | All versions |
| Ubuntu:16.04:LTS | canonical | percona-server-5.6 | All versions |
| Ubuntu:16.04:LTS | canonical | percona-xtradb-cluster-5.6 | All versions |
| Ubuntu:18.04:LTS | canonical | mariadb-10.1 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | mysql-8.0 | All versions |
| Ubuntu:20.04:LTS | canonical | mariadb-10.3 | All versions |
| Ubuntu:22.04:LTS | canonical | mariadb-10.6 | All versions |
| Ubuntu:24.04:LTS | canonical | mariadb | All versions |
| Ubuntu:26.04:LTS | canonical | mysql-8.4 | All versions |
| Root:Debian:12 | – | mariadb |
< 1:10.11.19-0+deb12u1.aikido.11 < 1:10.11.19-0+deb12u1.aikido.12 < 1:10.11.19-0+deb12u1.aikido.13 Fix: upgrade to 1:10.11.19-0+deb12u1.aikido.11
|
| Root:Debian:12 | – | rootio-mariadb |
< 1:10.11.19-0+deb12u1.aikido.11 < 1:10.11.19-0+deb12u1.aikido.12 < 1:10.11.19-0+deb12u1.aikido.13 Fix: upgrade to 1:10.11.19-0+deb12u1.aikido.11
|
| Root:Debian:13 | – | mariadb |
< 1:11.8.6-0+deb13u1.aikido.9 < 1:11.8.6-0+deb13u1.aikido.10 < 1:11.8.6-0+deb13u1.aikido.11 < 1:11.8.6-0+deb13u1.aikido.12 Fix: upgrade to 1:11.8.6-0+deb13u1.aikido.9
|
| Root:Debian:13 | – | rootio-mariadb |
< 1:11.8.6-0+deb13u1.aikido.9 < 1:11.8.6-0+deb13u1.aikido.10 < 1:11.8.6-0+deb13u1.aikido.11 < 1:11.8.6-0+deb13u1.aikido.12 Fix: upgrade to 1:11.8.6-0+deb13u1.aikido.9
|
| Alpaquita:23 | bellsoft | mariadb |
>= 10.6.12-r0, < 10.6.28-r0 Fix: upgrade to 10.6.28-r0
|
| Alpaquita:25 | bellsoft | mariadb |
>= 11.4.5-r0, < 11.4.13-r0 Fix: upgrade to 11.4.13-r0
|
| Alpaquita:stream | bellsoft | mariadb |
>= 10.11.4-r0, < 11.8.9-r0 Fix: upgrade to 11.8.9-r0
|
| Bitnami | – | mariadb |
>= 13.0.1, < 13.0.2 Fix: upgrade to 13.0.2
|
| Bitnami | – | mariadb-min |
>= 13.0.1, < 13.0.2 Fix: upgrade to 13.0.2
|
| Bitnami | – | mysql-client |
>= 13.0.1, < 13.0.2 Fix: upgrade to 13.0.2
|
Original advisory text
MariaDB: privilege escalation via incorrect view frm parsing
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
References
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19 URL
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28 URL
- https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c... Patch
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13 URL
- https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-107823 Vendor Advisory
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-1078... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-107823 Vendor Advisory
- https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3 URL
- https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2 URL
- https://jira.mariadb.org/browse/MDEV-40484 URL
- https://ubuntu.com/security/CVE-2026-107823 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-107823 Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-107823 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-116Improper Encoding or Escaping of Output
CWE-144Improper Neutralization of Line Delimiters
Timeline
Published9 Oct 2026
Updated4 Nov 2026
First seen9 Oct 2026
Sources
CVE-2026-107823 · NVD
CVE-2026-107823 · MITRE
DEBIAN-CVE-2026-107823 · OSV
CVE-2026-107823 · OSV
GHSA-g2q2-3936-cp37 · GHSA
UBUNTU-CVE-2026-107823 · OSV
BELL-CVE-2026-107823 · OSV
Track software like this
Free during beta