{"id":"CVE-2026-86047","kind":"vulnerability","aliases":["CVE-2026-86047"],"related":[],"title":"MariaDB: crafted object names let dump output run injected SQL","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","summary":"MariaDB's SHOW CREATE SERVER, SHOW CREATE USER and mariadb-dump do not consistently quote identifiers and values when generating SQL. A low-privileged user who creates objects with crafted names can get injected SQL to run when the poisoned output or dump is applied.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mariadb","fixed":["10.6.28"],"affected":">= 10.6.1, < 10.6.28","ecosystem":"vendor"},{"name":"mariadb","fixed":["10.11.19"],"affected":">= 10.11.1, < 10.11.19","ecosystem":"vendor"},{"name":"mariadb","fixed":["11.4.13"],"affected":">= 11.4.1, < 11.4.13","ecosystem":"vendor"},{"name":"mariadb","fixed":["11.8.9"],"affected":">= 11.8.1, < 11.8.9","ecosystem":"vendor"},{"name":"mariadb","fixed":["12.3.3"],"affected":">= 12.3.1, < 12.3.3","ecosystem":"vendor"},{"name":"mariadb","fixed":[],"affected":"= 13.0.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["backups","database","mariadb","runtime","self-hosted"],"not_affected_if":["fixed-version","no-untrusted-dump-restore"],"how_to_check":"- Run `SELECT VERSION();` or `mariadb --version` and compare against the fixed versions.\n- Check whether any dumps or SHOW output from untrusted or low-privileged accounts are restored or replayed.","fix":"- Upgrade MariaDB to `10.6.28`, `10.11.19`, `11.4.13`, `11.8.9`, `12.3.3` or `13.0.2`, matching your release branch.\n- Until upgraded, do not apply dumps or SHOW CREATE output that came from untrusted accounts.","status":"open","published_at":"2026-10-16T17:17:52+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:14:17+00:00","updated_at":"2026-10-25T03:14:17+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:14:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MariaDB to `10.6.28`, `10.11.19`, `11.4.13`, `11.8.9`, `12.3.3` or `13.0.2`, matching your release branch.\n- Until upgraded, do not apply dumps or SHOW CREATE output that came from untrusted accounts.","reach":"network","title":"MariaDB: crafted object names let dump output run injected SQL","impact":"high","summary":"MariaDB's SHOW CREATE SERVER, SHOW CREATE USER and mariadb-dump do not consistently quote identifiers and values when generating SQL. A low-privileged user who creates objects with crafted names can get injected SQL to run when the poisoned output or dump is applied.","category":"runtime","nicknames":[],"who_cares":["mariadb","database","self-hosted","backups"],"confidence":0.7,"needs_auth":"yes","worst_case":"Injected SQL runs when an operator applies a poisoned dump","analyst_note":"Products list 13.0.1 with no fix version, while the description says 13.0.2 is fixed; confirm the 13.0 fix version at the NVD entry or MariaDB advisory.","how_to_check":"- Run `SELECT VERSION();` or `mariadb --version` and compare against the fixed versions.\n- Check whether any dumps or SHOW output from untrusted or low-privileged accounts are restored or replayed.","needs_analyst":true,"not_affected_if":["fixed-version","no-untrusted-dump-restore"],"who_is_affected":"Teams running MariaDB 10.6.1 to 10.6.27, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, or 13.0.x before 13.0.2. The risk is highest where a low-privileged account can create objects and where dumps are reapplied by an operator or script. Servers that are not on those versions, or that never restore dumps from untrusted sources, have less exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001094,"input_tokens":3684,"output_tokens":1451,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86047':13A,16A '10.11.19':91C,183C '10.6.1':88C '10.6.28':90C,182C '11.4.13':92C,184C '11.8.9':93C,185C '12.3.3':94C,186C '13.0.2':96C,188C 'affect':108C 'appli':76B,175C 'attack':125C,133C,167C 'attacker-cr':132C 'attacker-inject':166C 'backup':23B 'communiti':81C 'consist':44B,113C 'contain':161C 'craft':2A,61B,137C,154C 'creat':33B,36B,58B,98C,101C,134C,150C 'cve':11A,14A 'databas':24B 'develop':82C 'dump':6A,41B,74B,106C,148C 'execut':165C 'fix':179C 'fork':83C 'generat':50B,159C 'get':64B 'host':29B 'identifi':46B,115C,138C,155C 'includ':142C 'inject':9A,65B,162C,168C 'issu':129C,177C 'let':5A 'low':54B,123C 'low-privileg':53B,122C 'mariadb':1A,17A,18A,19A,20A,21A,22A,25B,30B,40B,77C,105C 'mariadb-dump':39B,104C 'mysql':85C 'name':4A,62B 'object':3A,59B,135C,152C 'output':7A,72B,145C,173C 'poison':71B,172C 'privileg':55B,124C 'quot':45B,114C 'run':8A,68B 'runtim':26B 'self':28B 'self-host':27B 'serial':119C 'server':34B,78C,86C,99C 'show':32B,35B,97C,100C,144C 'sql':10A,51B,66B,120C,160C,169C 'statement':163C 'trigger':127C 'user':37B,56B,102C 'valu':48B,117C,140C,157C 'version':181C","nicknames":[],"mitigations":[],"who_affected":"Teams running MariaDB 10.6.1 to 10.6.27, 10.11.x before 10.11.19, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, or 13.0.x before 13.0.2. The risk is highest where a low-privileged account can create objects and where dumps are reapplied by an operator or script. Servers that are not on those versions, or that never restore dumps from untrusted sources, have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T17:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","severity":null,"published_at":"2026-10-16T17:17:52+00:00","modified_at":"2026-10-20T15:32:39+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}