CVE-2026-102523

Limit network access to the MariaDB service to trusted client hosts or localhost, and ensure non-administrative database accounts do not possess table alteration privileges.

1. Restrict network reachability:
To restrict MariaDB network access to trusted management subnets using firewalld:
# firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>
# firewall-cmd --permanent --remove-service=mysql
# firewall-cmd --reload

Alternatively, configure the service to bind only to the local loopback interface by adding or editing the following directive in `/etc/my.cnf.d/mariadb-server.cnf` under the `[mysqld]` section:
bind-address = 127.0.0.1

Apply the configuration by restarting the service:
# systemctl restart mariadb

2. Restrict user privileges:
Revoke the ALTER privilege from untrusted database accounts directly within MariaDB:
REVOKE ALTER ON <database_name>.* FROM '<user>'@'<host>';
FLUSH PRIVILEGES;

Caveats:
Restricting network access blocks remote connections from disallowed hosts. Binding to localhost prevents all remote connections. Revoking ALTER privileges prevents affected users from altering table schemas or partition configurations, which can impact applications that perform dynamic schema changes.

Warning:
Restarting the MariaDB service via systemctl will drop active database connections and cause temporary service unavailability.

--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to encode user-specified partition names via tablename_to_filename during ALTER TABLE CONVERT PARTITION filesystem path construction: upgrade to MariaDB 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2 (or the fixed Mariadb builds), which passes translate as true to create_partition_name so that partition names are encoded using tablename_to_filename during convert-in and convert-out routines, closing ALTER TABLE CONVERT PARTITION statements using partition names requiring filename escaping. Until patched, this is a concern on MariaDB instances with partitioning enabled where non-administrative users have ALTER privileges, so revoke ALTER privileges from non-administrative accounts, restrict database network access to trusted management hosts or localhost, or disable partitioning with --skip-plugin-partition. As a compensating measure, restrict database table operations to strictly defined directory boundaries and log executed ALTER TABLE statements and administrative database actions to SIEM. These controls limit blast radius and contain exploitation, but they do not fix the underlying partition name encoding defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)