CVE-2026-86047: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in MariaDB server

MariaDB server versions from 10.6.1 up to but excluding 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 are vulnerable to an SQL injection flaw (CWE-89). The flaw occurs because the commands SHOW CREATE SERVER, SHOW CREATE USER, and the mariadb-dump utility do not consistently quote identifiers and values when generating SQL output. This allows a low-privileged attacker to create objects with maliciously crafted identifiers or values that, when included in SHOW output or dumps, result in attacker-injected SQL statements being executed. This can lead to unauthorized SQL command execution. The issue has been addressed and fixed in the versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

The vulnerability allows a low-privileged attacker to execute arbitrary SQL commands by injecting malicious SQL through crafted object identifiers or values. This can lead to unauthorized data manipulation or denial of service. The CVSS score of 7.7 indicates high severity with network attack vector, high impact on integrity and availability, and requires low privileges with user interaction.

A fix is available and has been released in MariaDB server versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Users should upgrade to these or later versions to remediate the vulnerability. No other specific mitigations are indicated by the vendor advisory.