CVE-2026-97380
published 2026-10-16CVE-2026-97380: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY…
PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.56%
45.7th percentile
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb-devel_10.3 | mariadb | — | — |
| mariadb | mariadb | — | — |
| mariadb | mariadb | — | — |
| mariadb | mariadb | >= 10.11.1 < 10.11.19 | 10.11.19 |
| mariadb | mariadb | >= 10.6.1 < 10.6.28 | 10.6.28 |
| mariadb | mariadb | >= 11.4.1 < 11.4.13 | 11.4.13 |
| mariadb | mariadb | >= 11.8.1 < 11.8.9 | 11.8.9 |
| mariadb | mariadb | >= 12.3.1 < 12.3.3 | 12.3.3 |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb | server | — | — |
| mariadb_10.11 | mariadb | — | — |
| mariadb_10.3 | mariadb | — | — |
| mariadb_11.8 | mariadb | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-97380 mariadb11.8: mariadb: Privilege escalation via empty password in GRANT PROXY statement [fedora-all]
bugzilla·2026-10-23·CVSS 8.8
CVE-2026-97380 [HIGH] CVE-2026-97380 mariadb11.8: mariadb: Privilege escalation via empty password in GRANT PROXY statement [fedora-all]
CVE-2026-97380 mariadb11.8: mariadb: Privilege escalation via empty password in GRANT PROXY statement [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in vers
Bugzilla
CVE-2026-97380 mariadb10.11: mariadb: Privilege escalation via empty password in GRANT PROXY statement [fedora-all]
bugzilla·2026-10-23·CVSS 8.8
CVE-2026-97380 [HIGH] CVE-2026-97380 mariadb10.11: mariadb: Privilege escalation via empty password in GRANT PROXY statement [fedora-all]
CVE-2026-97380 mariadb10.11: mariadb: Privilege escalation via empty password in GRANT PROXY statement [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in ver
Bugzilla
CVE-2026-97380 mariadb12.3: mariadb: Privilege escalation via empty password in GRANT PROXY statement [fedora-all]
bugzilla·2026-10-23·CVSS 8.8
CVE-2026-97380 [HIGH] CVE-2026-97380 mariadb12.3: mariadb: Privilege escalation via empty password in GRANT PROXY statement [fedora-all]
CVE-2026-97380 mariadb12.3: mariadb: Privilege escalation via empty password in GRANT PROXY statement [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in vers
Bugzilla
CVE-2026-97380 mariadb: mariadb: Privilege escalation via empty password in GRANT PROXY statement
bugzilla·2026-10-16·CVSS 8.8
CVE-2026-97380 [HIGH] CVE-2026-97380 mariadb: mariadb: Privilege escalation via empty password in GRANT PROXY statement
CVE-2026-97380 mariadb: mariadb: Privilege escalation via empty password in GRANT PROXY statement
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmrhttps://jira.mariadb.org/browse/MDEV-40470
2026-10-16
Published