SQL Injection Vulnerability in MariaDB Server by MariaDB Corporation
CVE-2026-86047
What is CVE-2026-86047?
The MariaDB server, a community-developed fork of MySQL, is affected by a vulnerability that allows a low-privileged attacker to inject SQL statements. This occurs due to improper serialization of identifiers and values in the output of commands such as SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump. By crafting specific objects with manipulated identifiers, an attacker can create a situation where poisoned SQL output is processed, leading to the execution of unauthorized commands. The issue persists in multiple MariaDB versions and has been addressed in the latest updates, ensuring that identifiers and values are consistently quoted during serialization.
Affected Version(s)
server >= 10.6.1, < 10.6.28 < 10.6.1, 10.6.28
server >= 10.11.1, < 10.11.19 < 10.11.1, 10.11.19
server >= 11.4.1, < 11.4.13 < 11.4.1, 11.4.13