CVE-2026-86047
Description
A flaw was found in MariaDB, which can lead to SQL injection and privilege escalation. The SHOW CREATE SERVER and SHOW CREATE USER commands, as well as the mariadb-dump utility, do not properly quote identifiers and values when serializing SQL data. An authenticated, low-privileged attacker can exploit this issue by creating database objects with crafted identifiers or values to embed malicious commands into the generated SQL output. When the exported dump or output is subsequently executed, the injected SQL statements run with the privileges of the user applying the data.
Statement
This vulnerability is rated as Important severity for Red Hat Enterprise Linux environments because an attacker with minimal database privileges can compromise the integrity of administrative operations, potentially resulting in elevated SQL execution. In typical enterprise deployments where MariaDB hosts multi-tenant databases or permits unprivileged users to define schema objects, serialization routines fail to properly sanitize object identifiers. Consequently, when automated backup workflows or system administrators process and reapply generated schema exports or user definitions, injected commands execute under the context of the importing administrative account.
Mitigation
Upgrade to the fixed version of MariaDB Server
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.7 | N/A | 7.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
