Authorization Error in MariaDB Server Due to Improper Handling of Empty Passwords
CVE-2026-97380
What is CVE-2026-97380?
The MariaDB server has a vulnerability that arises from the improper treatment of the GRANT PROXY statement, specifically when an IDENTIFIED clause is given with an empty password. This misconfiguration can lead to the bypassing of authentication checks, ultimately allowing a low-privileged attacker to manipulate the privileges of other accounts. By exploiting this flaw, attackers can set passwords for accounts they do not own, potentially leading to further unauthorized access and actions within the system. This vulnerability affects multiple versions of the MariaDB server, and remedial updates have been provided in later versions.
Affected Version(s)
server >= 10.6.1, < 10.6.28 < 10.6.1, 10.6.28
server >= 10.11.1, < 10.11.19 < 10.11.1, 10.11.19
server >= 11.4.1, < 11.4.13 < 11.4.1, 11.4.13