---
id: CVE-2026-86047
title: >-
  mariadb: mariadb: SQL injection via improper identifier quoting
  (CVE-2026-86047)
summary: >-
  A flaw was found in MariaDB, which can lead to SQL injection and privilege
  escalation. The SHOW CREATE SERVER and SHOW CREATE USER commands, as well as
  the mariadb-dump utility, do not properly quote identifiers and values when
  serializing…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H'
cvssSource: vendor
cwe: CWE-89
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - enterprise_linux 10
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - openstack_platform_13_queens
  - hardened_images
patched:
  - hardened_images
published: '2026-10-16'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T16:38:49+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86047.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86047.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-86047'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554208'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-86047'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86047'
  - url: >-
      https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52
  - url: >-
      https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5
  - url: >-
      https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a
  - url: >-
      https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513
  - url: >-
      https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2'
  - url: 'https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p'
  - url: 'https://jira.mariadb.org/browse/MDEV-39776'
  - url: 'https://jira.mariadb.org/browse/MDEV-39818'
  - url: 'https://jira.mariadb.org/browse/MDEV-40308'
  - url: 'https://jira.mariadb.org/browse/MDEV-40311'
  - url: 'https://jira.mariadb.org/browse/MDEV-40312'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84701'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84689'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00856
epssPercentile: 0.58203
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-19T12:41:30.519558Z'
ingestedAt: '2026-10-16T17:24:46.890Z'
---

## Overview

A flaw was found in MariaDB, which can lead to SQL injection and privilege escalation. The SHOW CREATE SERVER and SHOW CREATE USER commands, as well as the mariadb-dump utility, do not properly quote identifiers and values when serializing SQL data. An authenticated, low-privileged attacker can exploit this issue by creating database objects with crafted identifiers or values to embed malicious commands into the generated SQL output. When the exported dump or output is subsequently executed, the injected SQL statements run with the privileges of the user applying the data.

## Vendor advisories

- **RHSA-2026:84701** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84701)
- **RHSA-2026:84689** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84689)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86047.json)

**mariadb: mariadb: SQL injection via improper identifier quoting** — rated Important by Red Hat. Released 2026-10-16, updated 2026-10-23.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenStack Platform 13 (Queens)

Fixed:

- Red Hat Hardened Images

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenStack Platform 13 (Queens)

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:84701
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:84689

Workarounds / mitigations:

- Upgrade to the fixed version of MariaDB Server