CVE-2026-107822
published 2026-10-09CVE-2026-107822: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache…
PriorityP339medium6.4CVSS 3.1
AVNACHPRHUIRSUCHIHAH
EPSS
0.48%
40.3th percentile
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb-devel_10.3 | mariadb | — | — |
| mariadb | mariadb | — | — |
| mariadb | mariadb | >= 10.11.1 < 10.11.19 | 10.11.19 |
| mariadb | mariadb | >= 10.6.1 < 10.6.28 | 10.6.28 |
| mariadb | mariadb | >= 11.4.1 < 11.4.13 | 11.4.13 |
| mariadb | mariadb | >= 11.8.1 < 11.8.9 | 11.8.9 |
| mariadb | mariadb | >= 12.3.1 < 12.3.3 | 12.3.3 |
| mariadb | mariadb | >= 13.0.1 < 13.0.2 | 13.0.2 |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb_10.11 | mariadb | — | — |
| mariadb_10.3 | mariadb | — | — |
| mariadb_11.8 | mariadb | — | — |
CVSS provenance
nvdv3.16.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
vendor_redhat6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mariadb: MariaDB: Privilege escalation via ACL cache key collision
vendor_redhat·2026-10-09·CVSS 6.4
CVE-2026-107822 [MEDIUM] CWE-694 mariadb: MariaDB: Privilege escalation via ACL cache key collision
mariadb: MariaDB: Privilege escalation via ACL cache key collision
A flaw was found in MariaDB. An issue in the Access Control List (ACL) cache causes identical privilege cache keys to be generated when a role and a local user share the same name. An attacker with user creation privileges can exploit this key collision by creating a matching account, allowing them to gain unauthorized access and exercise the database privileges of the targeted account.
Package: mariadb10.11 (Red Hat Enterprise Linux 10) - Fix deferred
Package: mariadb11.8 (Red Hat Enterprise Linux 10) - Fix deferred
Package: mariadb (Red Hat Enterprise Linux 7) - Fix deferred
Package: mariadb:10.11/mariadb (Red Hat Enterprise Linux 8) - Fix deferred
Package: mariadb:10.3/mariadb (Red Hat Enterprise Linux 8) - Fix def
VulDB
MariaDB up to 13.0.1 Acl Cache privileges management
vuldb·2026-10-09·CVSS 6.4
CVE-2026-107822 [MEDIUM] MariaDB up to 13.0.1 Acl Cache privileges management
A vulnerability labeled as very critical has been found in MariaDB up to 13.0.1. This affects an unknown part of the component Acl Cache. Executing a manipulation can lead to improper privilege management.
This vulnerability appears as CVE-2026-107822. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-107822 mariadb10.11: MariaDB: Privilege escalation via ACL cache key collision [fedora-all]
bugzilla·2026-10-22·CVSS 6.4
CVE-2026-107822 [MEDIUM] CVE-2026-107822 mariadb10.11: MariaDB: Privilege escalation via ACL cache key collision [fedora-all]
CVE-2026-107822 mariadb10.11: MariaDB: Privilege escalation via ACL cache key collision [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other
Bugzilla
CVE-2026-107822 mariadb12.3: MariaDB: Privilege escalation via ACL cache key collision [fedora-all]
bugzilla·2026-10-22·CVSS 6.4
CVE-2026-107822 [MEDIUM] CVE-2026-107822 mariadb12.3: MariaDB: Privilege escalation via ACL cache key collision [fedora-all]
CVE-2026-107822 mariadb12.3: MariaDB: Privilege escalation via ACL cache key collision [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other a
Bugzilla
CVE-2026-107822 mariadb11.8: MariaDB: Privilege escalation via ACL cache key collision [fedora-all]
bugzilla·2026-10-22·CVSS 6.4
CVE-2026-107822 [MEDIUM] CVE-2026-107822 mariadb11.8: MariaDB: Privilege escalation via ACL cache key collision [fedora-all]
CVE-2026-107822 mariadb11.8: MariaDB: Privilege escalation via ACL cache key collision [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other a
Bugzilla
CVE-2026-107822 mariadb: MariaDB: Privilege escalation via ACL cache key collision
bugzilla·2026-10-09·CVSS 6.4
CVE-2026-107822 [MEDIUM] CVE-2026-107822 mariadb: MariaDB: Privilege escalation via ACL cache key collision
CVE-2026-107822 mariadb: MariaDB: Privilege escalation via ACL cache key collision
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064bhttps://github.com/MariaDB/server/releases/tag/mariadb-10.11.19https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rfhttps://jira.mariadb.org/browse/MDEV-40541
2026-10-09
Published