CVE-2026-107823
published 2026-10-09CVE-2026-107823: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM…
PriorityP348high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.71%
53.0th percentile
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb-devel_10.3 | mariadb | — | — |
| mariadb | mariadb | — | — |
| mariadb | mariadb | >= 10.11.1 < 10.11.19 | 10.11.19 |
| mariadb | mariadb | >= 10.6.1 < 10.6.28 | 10.6.28 |
| mariadb | mariadb | >= 11.4.1 < 11.4.13 | 11.4.13 |
| mariadb | mariadb | >= 11.8.1 < 11.8.9 | 11.8.9 |
| mariadb | mariadb | >= 12.3.1 < 12.3.3 | 12.3.3 |
| mariadb | mariadb | >= 13.0.1 < 13.0.2 | 13.0.2 |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb_10.11 | mariadb | — | — |
| mariadb_10.3 | mariadb | — | — |
| mariadb_11.8 | mariadb | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mariadb: mariadb: Privilege escalation via unescaped newlines in view parser
vendor_redhat·2026-10-09·CVSS 7.2
CVE-2026-107823 [HIGH] CWE-93 mariadb: mariadb: Privilege escalation via unescaped newlines in view parser
mariadb: mariadb: Privilege escalation via unescaped newlines in view parser
A flaw was found in MariaDB. An authenticated user with permissions to create users and views can escalate database privileges by creating an account with a crafted username containing embedded newline characters. Due to improper encoding in the view format parser, the injected input is interpreted as security metadata, granting the user unauthorized elevated permissions.
Package: mariadb10.11 (Red Hat Enterprise Linux 10) - Affected
Package: mariadb11.8 (Red Hat Enterprise Linux 10) - Affected
Package: mariadb (Red Hat Enterprise Linux 7) - Affected
Package: mariadb:10.11/mariadb (Red Hat Enterprise Linux 8) - Affected
Package: mariadb:10.3/mariadb (Red Hat Enterprise Linux 8) - Affected
Package: mariadb-d
VulDB
MariaDB up to 13.0.1 FRM parser privileges management
vuldb·2026-10-09·CVSS 7.2
CVE-2026-107823 [HIGH] MariaDB up to 13.0.1 FRM parser privileges management
A vulnerability has been found in MariaDB up to 13.0.1 and classified as problematic. This impacts an unknown function of the component FRM parser. The manipulation leads to improper privilege management.
This vulnerability is referenced as CVE-2026-107823. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-107823 mariadb10.11: mariadb: Privilege escalation via unescaped newlines in view parser [fedora-all]
bugzilla·2026-10-12·CVSS 7.2
CVE-2026-107823 [HIGH] CVE-2026-107823 mariadb10.11: mariadb: Privilege escalation via unescaped newlines in view parser [fedora-all]
CVE-2026-107823 mariadb10.11: mariadb: Privilege escalation via unescaped newlines in view parser [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating da
Bugzilla
CVE-2026-107823 mariadb11.8: mariadb: Privilege escalation via unescaped newlines in view parser [fedora-all]
bugzilla·2026-10-12·CVSS 7.2
CVE-2026-107823 [HIGH] CVE-2026-107823 mariadb11.8: mariadb: Privilege escalation via unescaped newlines in view parser [fedora-all]
CVE-2026-107823 mariadb11.8: mariadb: Privilege escalation via unescaped newlines in view parser [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating dat
Bugzilla
CVE-2026-107823 mariadb12.3: mariadb: Privilege escalation via unescaped newlines in view parser [fedora-all]
bugzilla·2026-10-12·CVSS 7.2
CVE-2026-107823 [HIGH] CVE-2026-107823 mariadb12.3: mariadb: Privilege escalation via unescaped newlines in view parser [fedora-all]
CVE-2026-107823 mariadb12.3: mariadb: Privilege escalation via unescaped newlines in view parser [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating dat
Bugzilla
CVE-2026-107823 mariadb: mariadb: Privilege escalation via unescaped newlines in view parser
bugzilla·2026-10-09·CVSS 7.2
CVE-2026-107823 [HIGH] CVE-2026-107823 mariadb: mariadb: Privilege escalation via unescaped newlines in view parser
CVE-2026-107823 mariadb: mariadb: Privilege escalation via unescaped newlines in view parser
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37https://jira.mariadb.org/browse/MDEV-40484
2026-10-09
Published