cveboard RSS feed

CVE-2026-86047

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

MariaDB: Insufficient quoting in mariadb-dump and SHOW commands

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

server

Vendor
MariaDB
Product
server
Platforms
Unknown
Default status
Unknown
server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 10.6.1, < 10.6.28affectedUnavailableUnavailableUnavailableNone listed
>= 10.11.1, < 10.11.19affectedUnavailableUnavailableUnavailableNone listed
>= 11.4.1, < 11.4.13affectedUnavailableUnavailableUnavailableNone listed
>= 11.8.1, < 11.8.9affectedUnavailableUnavailableUnavailableNone listed
>= 12.3.1, < 12.3.3affectedUnavailableUnavailableUnavailableNone listed
>= 13.0.1, < 13.0.2affectedUnavailableUnavailableUnavailableNone listed