CVE-2026-107823: 
MariaDB Server Análisis y mitigación de vulnerabilidades

CVE-2026-107823 is a privilege escalation vulnerability in MariaDB Server caused by improper encoding of newline characters in usernames within the view FRM parser. An authenticated account holding CREATE USER and CREATE VIEW WITH GRANT OPTION privileges can craft a username containing embedded newlines and additional view metadata, causing the parser to misinterpret part of the username as security metadata and potentially escalating database privileges. Affected versions span 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, and 13.0.1. The vulnerability was disclosed on September 7, 2026, and carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified under CWE-116 (Improper Encoding or Escaping of Output), CWE-144 (Improper Neutralization of Line Delimiters), and CWE-93 (CRLF Injection). In sql/sql_view.cc, the definer_user and definer_host fields in the view FRM parameter table were written using FILE_OPTIONS_STRING — an unescaped string type — rather than FILE_OPTIONS_ESTRING, which applies proper escaping. This allowed a crafted username containing literal newline characters (e.g., root\ndefiner_host=localhost\nsuid=1) to inject additional key-value pairs into the FRM file, which the parser would then interpret as legitimate view security metadata. The fix, committed as MDEV-40484, changes both definer_user and definer_host to use FILE_OPTIONS_ESTRING and deprecates FILE_OPTIONS_STRING for future releases (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated database user with limited but elevated permissions (CREATE USER + CREATE VIEW WITH GRANT OPTION) to escalate their privileges within the MariaDB database engine. By manipulating the view's security context metadata, the attacker could gain access to data or operations normally restricted to higher-privileged accounts, resulting in high confidentiality, integrity, and availability impact on the database server. The scope is limited to the database instance itself (no scope change), but unauthorized access to sensitive tables such as mysql.global_priv could expose credential and privilege data for all database users (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). Exploitation requires an authenticated account with CREATE USER and CREATE VIEW WITH GRANT OPTION privileges, which are high-privilege administrative operations, limiting the attacker pool. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was detected by Nessus plugin 364510 (Tenable).

1. Obtain required privileges: Acquire a MariaDB account with both CREATE USER and CREATE VIEW WITH GRANT OPTION privileges on a vulnerable server (versions 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, or 13.0.1).
2. Craft a malicious username: Create a username that embeds newline characters followed by FRM metadata key-value pairs, for example:

   CREATE USER 'root\ndefiner_host=localhost\nsuid=1'@'localhost';

   This causes the username string to contain literal newlines that the FRM parser will interpret as field delimiters.
3. Connect as the crafted user: Authenticate to the MariaDB server using the newly created account.
4. Create a view leveraging the injected metadata: While connected as the crafted user, create a view that references a privileged resource (e.g., a function querying mysql.global_priv):

   CREATE FUNCTION f() RETURNS TEXT SQL SECURITY INVOKER
     RETURN (SELECT group_concat(user,'@',host) FROM mysql.global_priv);
   CREATE VIEW v AS SELECT f();

5. Trigger FRM parsing: The view's FRM file is written with the unescaped username, injecting definer_host and suid fields. When the view is subsequently parsed, the server interprets the injected metadata as legitimate security context, potentially executing the view with escalated privileges.
6. Access privileged data: Query the view or leverage the escalated security context to access data or perform operations beyond the account's original authorization (GitHub Advisory, GitHub Commit).

• Database Logs: Presence of usernames containing literal newline characters (\n) in MariaDB general query logs or audit logs, particularly in CREATE USER statements.
• Database Artifacts: View FRM files on disk (typically under the MariaDB data directory, e.g., /var/lib/mysql/<db>/) containing unexpected multi-line definer_user or definer_host fields with embedded newlines.
• Database State: Existence of user accounts with unusual names containing newline sequences in mysql.global_priv or mysql.user tables:

  SELECT user, host FROM mysql.global_priv WHERE user LIKE '%\n%';

• Database State: Views in information_schema.views where the DEFINER column contains newline characters or unexpected metadata strings.
• Logs: Unexpected privilege escalation events or access to mysql.global_priv by accounts that should not have SELECT on that table, visible in the MariaDB audit log plugin output (GitHub Advisory).

Upgrade MariaDB Server to one of the patched versions: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 (GitHub Advisory). As a workaround prior to patching, restrict CREATE USER and CREATE VIEW WITH GRANT OPTION privileges to only fully trusted, high-privileged administrative accounts — in most standard installations this is already the case, which limits practical exposure. Audit existing user accounts for names containing newline characters and remove any suspicious accounts found in mysql.global_priv (Red Hat CVE).

The vulnerability was reported by Ben Bidner of the Automattic.com Security Team and credited to researcher vortfu in the GitHub Security Advisory (GitHub Advisory). Red Hat has acknowledged the issue and published a CVE advisory page (Red Hat CVE). No significant broader media coverage or notable social media discussion has been identified at this time.