---
id: "CVE-2026-86047"
kind: "vulnerability"
aliases: ["CVE-2026-86047"]
title: "MariaDB: crafted object names let dump output run injected SQL"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "mariadb", "fixed": ["10.6.28"], "affected": ">= 10.6.1, < 10.6.28", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["10.11.19"], "affected": ">= 10.11.1, < 10.11.19", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["11.4.13"], "affected": ">= 11.4.1, < 11.4.13", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["11.8.9"], "affected": ">= 11.8.1, < 11.8.9", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": ["12.3.3"], "affected": ">= 12.3.1, < 12.3.3", "ecosystem": "vendor"}, {"name": "mariadb", "fixed": [], "affected": "= 13.0.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["backups", "database", "mariadb", "runtime", "self-hosted"]
not_affected_if: ["fixed-version", "no-untrusted-dump-restore"]
published_at: "2026-10-16T17:17:52+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:14:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86047", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# MariaDB: crafted object names let dump output run injected SQL

MariaDB's SHOW CREATE SERVER, SHOW CREATE USER and mariadb-dump do not consistently quote identifiers and values when generating SQL. A low-privileged user who creates objects with crafted names can get injected SQL to run when the poisoned output or dump is applied.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mariadb affected >= 10.6.1, < 10.6.28 fixed 10.6.28
- vendor:mariadb affected >= 10.11.1, < 10.11.19 fixed 10.11.19
- vendor:mariadb affected >= 11.4.1, < 11.4.13 fixed 11.4.13
- vendor:mariadb affected >= 11.8.1, < 11.8.9 fixed 11.8.9
- vendor:mariadb affected >= 12.3.1, < 12.3.3 fixed 12.3.3
- vendor:mariadb affected = 13.0.1 fixed ?

## How to check

- Run `SELECT VERSION();` or `mariadb --version` and compare against the fixed versions.
- Check whether any dumps or SHOW output from untrusted or low-privileged accounts are restored or replayed.

## Fix

- Upgrade MariaDB to `10.6.28`, `10.11.19`, `11.4.13`, `11.8.9`, `12.3.3` or `13.0.2`, matching your release branch.
- Until upgraded, do not apply dumps or SHOW CREATE output that came from untrusted accounts.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86047

## From the sources

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_