---
id: CVE-2026-92262
title: >-
  mariadb: MariaDB: Numerous issues caused by historical #mysql50# tablename
  encoding bypass. (CVE-2026-92262)
summary: >-
  A flaw was found in MariaDB. An authenticated remote attacker can supply a
  crafted table name with the #mysql50# prefix, which bypasses normal filesystem
  encoding for table names. By accessing files under unencoded legacy names, the
  attack…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe:
  - CWE-73
  - CWE-706
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - hardened_images
  - openstack_platform_13_queens
published: '2026-10-16'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T11:01:20+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92262.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92262.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92262'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554205'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92262'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92262'
  - url: >-
      https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e
  - url: >-
      https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3'
  - url: 'https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2'
  - url: 'https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h'
  - url: 'https://jira.mariadb.org/browse/MDEV-40362'
tags:
  - csaf
  - vex
  - red-hat
  - exploit-available
  - cve.org
epss: 0.01451
epssPercentile: 0.7324
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/SeanDishman/mariadb-cve-2026-92262'
  checkedAt: '2026-10-27T19:22:38.938Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-21T02:27:59.402947Z'
scores:
  vendor: 8.8
  cna: 9.9
ingestedAt: '2026-10-16T17:24:46.888Z'
---

## Overview

A flaw was found in MariaDB. An authenticated remote attacker can supply a crafted table name with the #mysql50# prefix, which bypasses normal filesystem encoding for table names. By accessing files under unencoded legacy names, the attacker can achieve arbitrary code execution, exfiltrate sensitive information, corrupt data, or trigger a denial of service (DoS) by crashing the database server.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92262.json)

**mariadb: MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.** — rated Important by Red Hat. Released 2026-10-16, updated 2026-10-26.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenStack Platform 13 (Queens)

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenStack Platform 13 (Queens)

Not affected:

- Red Hat Hardened Images

## Remediation

Affected

Workarounds / mitigations:

- Upgrade to the fixed version of MariaDB Server