CVE-2026-107823

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107823", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-08T21:23:59.823Z", "datePublished": "2026-10-09T17:30:36.062Z", "dateUpdated": "2026-10-13T17:04:53.917Z"}, "containers": {"cna": {"title": "MariaDB: privilege escalation via incorrect view frm parsing", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-144", "lang": "en", "description": "CWE-144: Improper Neutralization of Line Delimiters", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37"}, {"name": "https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"}, {"name": "https://jira.mariadb.org/browse/MDEV-40484", "tags": ["x_refsource_MISC"], "url": "https://jira.mariadb.org/browse/MDEV-40484"}], "affected": [{"vendor": "MariaDB", "product": "server", "versions": [{"version": ">= 10.6.1, < 10.6.28", "status": "affected"}, {"version": ">= 10.11.1, < 10.11.19", "status": "affected"}, {"version": ">= 11.4.1, < 11.4.13", "status": "affected"}, {"version": ">= 11.8.1, < 11.8.9", "status": "affected"}, {"version": ">= 12.3.1, < 12.3.3", "status": "affected"}, {"version": ">= 13.0.1, < 13.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-09T17:30:36.062Z"}, "descriptions": [{"lang": "en", "value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}], "source": {"advisory": "GHSA-g2q2-3936-cp37", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T17:04:40.331253Z", "id": "CVE-2026-107823", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T17:04:53.917Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107823", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-13T17:04:40.331253Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T17:04:48.139Z"}}], "cna": {"title": "MariaDB: privilege escalation via incorrect view frm parsing", "source": {"advisory": "GHSA-g2q2-3936-cp37", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "MariaDB", "product": "server", "versions": [{"status": "affected", "version": ">= 10.6.1, < 10.6.28"}, {"status": "affected", "version": ">= 10.11.1, < 10.11.19"}, {"status": "affected", "version": ">= 11.4.1, < 11.4.13"}, {"status": "affected", "version": ">= 11.8.1, < 11.8.9"}, {"status": "affected", "version": ">= 12.3.1, < 12.3.3"}, {"status": "affected", "version": ">= 13.0.1, < 13.0.2"}]}], "references": [{"url": "https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37", "name": "https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4", "name": "https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19", "name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28", "name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13", "name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9", "name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3", "name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2", "name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2", "tags": ["x_refsource_MISC"]}, {"url": "https://jira.mariadb.org/browse/MDEV-40484", "name": "https://jira.mariadb.org/browse/MDEV-40484", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-144", "description": "CWE-144: Improper Neutralization of Line Delimiters"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-09T17:30:36.062Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107823", "state": "PUBLISHED", "dateUpdated": "2026-10-13T17:04:53.917Z", "dateReserved": "2026-10-08T21:23:59.823Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-09T17:30:36.062Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "server", "vendor": "MariaDB", "versions": [{"status": "affected", "version": ">= 10.6.1, < 10.6.28"}, {"status": "affected", "version": ">= 10.11.1, < 10.11.19"}, {"status": "affected", "version": ">= 11.4.1, < 11.4.13"}, {"status": "affected", "version": ">= 11.8.1, < 11.8.9"}, {"status": "affected", "version": ">= 12.3.1, < 12.3.3"}, {"status": "affected", "version": ">= 13.0.1, < 13.0.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A6667AA-6A82-49E2-894B-318569872468", "versionEndExcluding": "10.6.28", "versionStartIncluding": "10.6.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "C18A44B6-CEEF-47D7-9D60-04E6EBAFC785", "versionEndExcluding": "10.11.19", "versionStartIncluding": "10.11.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "47070DA5-F754-4FE1-957A-375C39D9029E", "versionEndExcluding": "11.4.13", "versionStartIncluding": "11.4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "39AD11EC-57BE-4D2B-9A7C-E667E23A6940", "versionEndExcluding": "11.8.9", "versionStartIncluding": "11.8.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6988F1C-2D11-431B-BBE4-3AA8483627C8", "versionEndExcluding": "12.3.3", "versionStartIncluding": "12.3.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "B427DCA2-1080-4276-9C4C-D90BA53DDDBF", "versionEndExcluding": "13.0.2", "versionStartIncluding": "13.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}], "id": "CVE-2026-107823", "lastModified": "2026-10-14T14:13:32.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107823", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T17:04:40.331253Z", "version": "2.0.3"}}]}, "published": "2026-10-09T18:17:04.190", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://jira.mariadb.org/browse/MDEV-40484"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}, {"lang": "en", "value": "CWE-144"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mariadb: mariadb: Privilege escalation via unescaped newlines in view parser", "id": "2548750", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548750"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-93", "details": ["A flaw was found in MariaDB. An authenticated user with permissions to create users and views can escalate database privileges by creating an account with a crafted username containing embedded newline characters. Due to improper encoding in the view format parser, the injected input is interpreted as security metadata, granting the user unauthorized elevated permissions."], "name": "CVE-2026-107823", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "mariadb10.11", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "mariadb11.8", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "mariadb", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "mariadb:10.11/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "mariadb:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "mariadb-devel:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "mariadb:10.11/mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "mariadb:11.8/mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "mariadb10.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "mariadb11.8", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "mariadb", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}], "public_date": "2026-10-09T17:30:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107823\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107823\nhttps://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4\nhttps://github.com/MariaDB/server/releases/tag/mariadb-10.11.19\nhttps://github.com/MariaDB/server/releases/tag/mariadb-10.6.28\nhttps://github.com/MariaDB/server/releases/tag/mariadb-11.4.13\nhttps://github.com/MariaDB/server/releases/tag/mariadb-11.8.9\nhttps://github.com/MariaDB/server/releases/tag/mariadb-12.3.3\nhttps://github.com/MariaDB/server/releases/tag/mariadb-13.0.2\nhttps://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37\nhttps://jira.mariadb.org/browse/MDEV-40484"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.6.1,10.6.28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.11.1,10.11.19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.4.1,11.4.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.8.1,11.8.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.1,12.3.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.1,13.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "server", "source": "cna", "vendor": "MariaDB"}, "product": "server", "vendor": "mariadb"}], "created": "2026-10-09T18:30:11.088665+00:00", "updated": "2026-10-10T01:30:14.738905+00:00", "vendors": ["mariadb", "mariadb$PRODUCT$server"]}