CVE-2026-97380

A flaw was found in MariaDB. An authenticated attacker with low privileges can achieve privilege escalation by modifying the password of another database account. This vulnerability occurs because the database server checks incorrect authorization privileges when processing a GRANT PROXY statement containing an empty password clause, allowing the attacker to compromise target accounts.

This vulnerability is evaluated as having an Important impact for Red Hat environments because an authenticated user with minimal access can escalate privileges to take over arbitrary database accounts, including administrative users, leading to a complete compromise of database confidentiality and integrity. In typical deployments across Red Hat Enterprise Linux, MariaDB hosts multi-tenant or shared application workloads where untrusted or lower-tier users might hold valid login credentials. Although exploitation requires active network access and valid database authentication, the authorization flaw permits bypassing privilege boundaries without requiring grant permissions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to the fixed version of MariaDB Server