CVE-2026-86047

A flaw was found in MariaDB, which can lead to SQL injection and privilege escalation. The SHOW CREATE SERVER and SHOW CREATE USER commands, as well as the mariadb-dump utility, do not properly quote identifiers and values when serializing SQL data. An authenticated, low-privileged attacker can exploit this issue by creating database objects with crafted identifiers or values to embed malicious commands into the generated SQL output. When the exported dump or output is subsequently executed, the injected SQL statements run with the privileges of the user applying the data.

This vulnerability is rated as Important severity for Red Hat Enterprise Linux environments because an attacker with minimal database privileges can compromise the integrity of administrative operations, potentially resulting in elevated SQL execution. In typical enterprise deployments where MariaDB hosts multi-tenant databases or permits unprivileged users to define schema objects, serialization routines fail to properly sanitize object identifiers. Consequently, when automated backup workflows or system administrators process and reapply generated schema exports or user definitions, injected commands execute under the context of the importing administrative account.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to the fixed version of MariaDB Server