CVE-2026-86047: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-86047 is an SQL injection vulnerability in MariaDB Server caused by insufficient quoting of identifiers and values in the SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump commands. Affected versions span from 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1. The vulnerability was published on September 7, 2026 via a GitHub Security Advisory and assigned CVE-2026-86047. It carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Feedly).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump fail to consistently quote identifiers and string values when serializing SQL output. Specifically, identifiers such as trigger names, plugin names, server names, and option names were emitted without proper backtick quoting, and string values were not always escaped with append_unescaped(). Fixes applied across multiple commits corrected these issues: for example, MDEV-40311 fixed mariadb-dump not quoting identifiers for DROP TRIGGER, INSTALL PLUGIN, CREATE FUNCTION, and CREATE SERVER; MDEV-40308 fixed single quotes in SHOW CREATE USER making output invalid; and MDEV-40312 fixed SHOW CREATE SERVER not quoting option names (GitHub Advisory, Commit 2b28d1c, Commit 9d4ffe2). Exploitation requires a low-privileged attacker to create a database object (e.g., a server, user, trigger, or plugin) with crafted identifiers or values containing SQL metacharacters, then wait for an administrator or automated process to capture and re-apply the poisoned SHOW output or dump.

A low-privileged MariaDB user can craft database objects whose serialized SQL output — when captured via SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump and subsequently applied by an administrator or automated pipeline — executes attacker-injected SQL statements with the privileges of the user applying the dump. This can result in high integrity impact (arbitrary SQL execution, privilege escalation, data modification) and high availability impact (data destruction, service disruption), though there is no direct confidentiality impact per the CVSS scoring. The scope is changed, meaning the impact can extend beyond the MariaDB instance itself to dependent systems or data (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is 0.0, reflecting very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges, network access, high attack complexity, and user interaction (an administrator must apply the poisoned output), limiting its practical exploitability (GitHub Advisory).

1. Gain low-privileged access: Obtain a MariaDB account with sufficient privileges to create servers, users, triggers, or install plugins on a vulnerable instance (versions 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, or 13.0.1).
2. Create a malicious object: Create a database object with a crafted identifier or value containing SQL metacharacters. For example, create a server with a name or option value that, when unquoted in SHOW CREATE SERVER output, breaks out of the expected SQL context and injects additional statements (e.g., CREATE SERVER s1 FOREIGN DATA WRAPPER mysql OPTIONS (host 'value; DROP TABLE sensitive_table; --')).
3. Trigger SHOW or dump output: Wait for or social-engineer an administrator to run SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump --system=servers (or similar options like --add-drop-trigger, --system, --include-master-host-port) that includes the malicious object.
4. Poison the output: The generated SQL output will contain the injected SQL statements due to missing or incorrect quoting of the crafted identifier/value.
5. Achieve SQL execution: When the administrator or an automated process applies the poisoned dump or SHOW output to a MariaDB instance, the injected SQL executes with the privileges of the applying user, potentially enabling privilege escalation, data manipulation, or further compromise (GitHub Advisory, Commit 2b28d1c).

• Database: Presence of database objects (servers, users, triggers, plugins) with unusual names containing SQL metacharacters such as single quotes ('), backticks (`), semicolons (;), or SQL keywords embedded in identifiers.
• Logs: MariaDB general query log entries showing CREATE SERVER, CREATE USER, or CREATE TRIGGER statements with anomalous identifier names; unexpected SQL statements executed during dump restoration that were not part of the original schema.
• File System: Dump files (.sql) generated by mariadb-dump containing unexpected SQL statements outside the normal dump structure, particularly around CREATE SERVER, INSTALL PLUGIN, CREATE FUNCTION, DROP TRIGGER, or CHANGE MASTER blocks.
• Process/Audit: Execution of mariadb-dump with options --add-drop-trigger, --system, or --include-master-host-port followed shortly by application of the resulting dump file; unexpected privilege changes or table drops occurring during dump restoration.

Upgrade MariaDB Server to the fixed versions: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 depending on the deployed branch (GitHub Advisory). As interim workarounds, manually inspect dump files for structural irregularities before applying them, as legitimate dumps have a very regular format. Avoid using the mariadb-dump options --add-drop-trigger, --system, and --include-master-host-port on vulnerable versions, and do not apply dumps generated by vulnerable MariaDB versions without review. Restrict the ability to create servers, users, and install plugins to trusted administrators only to reduce the attack surface (GitHub Advisory, Feedly).

The vulnerability was credited to Ben Bidner of the Automattic.com Security Team and reported by vortfu, with the fix developed by MariaDB contributor vuvova (GitHub Advisory). Red Hat tracked the issue via Bugzilla (BZ#2554208) and published a CVE advisory page, indicating downstream Linux distribution awareness (Red Hat CVE). No significant broader media coverage or notable social media discussion has been identified beyond standard CVE aggregator postings.