{"id":"CVE-2026-86047","title":"mariadb: mariadb: SQL injection via improper identifier quoting (CVE-2026-86047)","summary":"A flaw was found in MariaDB, which can lead to SQL injection and privilege escalation. The SHOW CREATE SERVER and SHOW CREATE USER commands, as well as the mariadb-dump utility, do not properly quote identifiers and values when serializing…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","cvssSource":"vendor","cwe":"CWE-89","vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","openstack_platform_13_queens","hardened_images"],"patched":["hardened_images"],"published":"2026-10-16","updated":"2026-10-23","sourceUpdated":"2026-10-23T16:38:49+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86047.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86047.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-86047"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554208"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86047"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047"},{"url":"https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52"},{"url":"https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5"},{"url":"https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a"},{"url":"https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513"},{"url":"https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p"},{"url":"https://jira.mariadb.org/browse/MDEV-39776"},{"url":"https://jira.mariadb.org/browse/MDEV-39818"},{"url":"https://jira.mariadb.org/browse/MDEV-40308"},{"url":"https://jira.mariadb.org/browse/MDEV-40311"},{"url":"https://jira.mariadb.org/browse/MDEV-40312"},{"url":"https://access.redhat.com/errata/RHSA-2026:84701"},{"url":"https://access.redhat.com/errata/RHSA-2026:84689"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00856,"epssPercentile":0.58203,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-19T12:41:30.519558Z"},"ingestedAt":"2026-10-16T17:24:46.890Z","slug":"CVE-2026-86047","body":"## Overview\n\nA flaw was found in MariaDB, which can lead to SQL injection and privilege escalation. The SHOW CREATE SERVER and SHOW CREATE USER commands, as well as the mariadb-dump utility, do not properly quote identifiers and values when serializing SQL data. An authenticated, low-privileged attacker can exploit this issue by creating database objects with crafted identifiers or values to embed malicious commands into the generated SQL output. When the exported dump or output is subsequently executed, the injected SQL statements run with the privileges of the user applying the data.\n\n## Vendor advisories\n\n- **RHSA-2026:84701** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84701)\n- **RHSA-2026:84689** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84689)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86047.json)\n\n**mariadb: mariadb: SQL injection via improper identifier quoting** — rated Important by Red Hat. Released 2026-10-16, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenStack Platform 13 (Queens)\n\nFixed:\n\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenStack Platform 13 (Queens)\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:84701\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:84689\n\nWorkarounds / mitigations:\n\n- Upgrade to the fixed version of MariaDB Server","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}