CVE-2026-86047High· 7.7▾ Twilight

MariaDB: Insufficient quoting in mariadb-dump and SHOW commands

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score42/ 100 · Moderate

impact 42.4 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 16, 2026

Updated

Oct 16, 2026

CVSS

7.7

Vendor

MariaDB

Product

server

CWE

CWE-89

Depth score

42 · Moderate

EPSS

—

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H

MariaDB CWE-89 #cve.org

Affected

server >= 10.6.1, < 10.6.28
server >= 10.11.1, < 10.11.19
server >= 11.4.1, < 11.4.13
server >= 11.8.1, < 11.8.9
server >= 12.3.1, < 12.3.3
server >= 13.0.1, < 13.0.2

Full technical detail▾

Overview

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Affected

server >= 10.6.1, < 10.6.28
server >= 10.11.1, < 10.11.19
server >= 11.4.1, < 11.4.13
server >= 11.8.1, < 11.8.9
server >= 12.3.1, < 12.3.3
server >= 13.0.1, < 13.0.2

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org