EUVD-2026-102943Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged DB account
-
DeliveryCreate object with crafted identifiers/values
-
ExploitAdmin runs mariadb-dump or SHOW CREATE
-
ExecutionUnquoted identifiers serialized into SQL
-
PersistOperator applies poisoned dump
-
ImpactInjected SQL executes with operator privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a low-privileged authenticated account able to create a database object whose identifier or option value it controls - specifically a FOREIGN DATA WRAPPER SERVER (SHOW CREATE SERVER / dump_all_servers), a USER (SHOW CREATE USER), a UDF, an installed plugin, or a trigger, as shown in the patched sinks; and (2) a privileged operator must subsequently serialize that object via SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump AND then apply/restore the generated SQL, because MariaDB does not consistently quote the identifiers/values. The attack is strongly limited by this required victim action (UI:R) and by the need for a pre-existing foothold account (PR:L): it does not fire automatically and cannot be triggered by a fully unauthenticated remote attacker. It affects MariaDB server versions from 10.6.1 up to the fixed releases regardless of special configuration, but only manifests when the dump/restore or SHOW-and-replay workflow is actually performed. |
| Impact | This is a genuine but conditional threat rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H, base 7.7 High) tells a coherent story that matches the description: a network-reachable but low-privileged attacker (PR:L) plants a database object with maliciously crafted identifiers/values, and the payload only detonates when a privileged operator serializes that object via SHOW CREATE SERVER / SHOW CREATE USER / mariadb-dump and later re-applies the output - hence AC:H (dependence on a victim workflow and specific crafted content) and UI:R (an administrator must run the dump/restore). The scope change (S:C) correctly reflects that injected SQL executes with the authority of the operator applying the output, which can be far higher than the attacker's own account, driving I:H and A:H; C:N reflects that the attacker does not necessarily receive query output back. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is referenced - so exploitation is CONFIRMED only as a code-level defect fixed by vendor commits, not as observed in-the-wild activity. The signals are internally consistent (no CVSS-vs-description conflict), but the exploitation chain requires both a foothold account and a victim-triggered dump/restore cycle, so real-world priority is moderate: patch promptly, but this is not drive-by remote code execution. |
| Exploit ScenarioDerived | A user with limited privileges (enough to CREATE a SERVER, USER, UDF, plugin, or trigger) creates an object whose name or option values embed crafted SQL that MariaDB fails to quote consistently when serializing. Later an administrator runs mariadb-dump (e.g. for backup/migration) and restores the dump, at which point the unquoted identifiers break out of their intended context and execute the attacker's injected statements with the restoring user's privileges. No public exploit code is referenced in the provided data, but the fixing commits publicly show the exact unquoted sinks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
RemediationAI
Vendor-released patch: upgrade to MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 or 13.0.2 (any branch at or above the corresponding fixed release), each of which rewrites the dump and SHOW CREATE emitters to use quote_name(), quote_for_equal(), unescape() and numeric coercion for identifiers and option values; see the release tags listed above, the advisory at https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p, and the fixes at https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52, https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5, https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a, https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513 and https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b. If immediate upgrading is not possible, the highest-value compensating control is to remove the precondition rather than the symptom: revoke CREATE SERVER/FOREIGN DATA WRAPPER, CREATE FUNCTION (UDF), INSTALL PLUGIN and CREATE TRIGGER privileges from all non-administrative accounts, which prevents an attacker from planting the poisoned identifiers at all, with the trade-off that legitimate application-level plugin, UDF or FDW workflows will break. Second, treat every dump or SHOW CREATE output as untrusted input: review generated SQL for unexpected additional statements before applying it, restore only from dumps produced by trusted administrators, and avoid piping mariadb-dump output directly into a privileged client in automated jobs - this adds manual review overhead and does not scale, but neutralizes the execution step. Third, restrict and monitor RESTORE/import operations so that only a controlled account can replay serialized SQL, and audit mysql.servers plus existing UDFs, plugins and triggers for suspicious names or SONAME values that may already be staged; note that this is detection, not prevention, and that removing a hostile object after a dump has already been replayed does not undo the injected statements. Since no vendor patch exists for branches below the fixed versions listed above, upgrading remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 (improper neutralization of special elements used in SQL commands), realized here not in a classic query-building path but in MariaDB's serialization of metadata back into executable SQL. MariaDB Server, the community fork of MySQL tracked as cpe:2.3:a:mariadb:server, exposes DDL reconstruction through SHOW CREATE SERVER, SHOW CREATE USER and the mariadb-dump client, which reads catalog tables such as mysql.servers and mysql.user and re-emits them as CREATE SERVER ... FOREIGN DATA WRAPPER ... OPTIONS (...), CREATE FUNCTION ... SONAME, INSTALL PLUGIN ... SONAME, CREATE TRIGGER and CHANGE MASTER statements. In affected builds these emitters wrapped string values in single quotes without escaping embedded quotes, and emitted object names without identifier quoting, so an object whose name or option value contained crafted characters produced syntactically broken or malicious SQL. The upstream fix (commits in client/mysqldump.c and the server paths referenced in GHSA-wxr3-wm3p-7w6p and JIRA MDEV-39776/MDEV-39818/MDEV-40308) replaces naive fprintf concatenation with quote_name() for identifiers, quote_for_equal() for replication options, and unescape() for string values such as the FDW wrapper, SONAME, host, and log file, plus numeric coercion for ports and log positions. The vulnerability is structural to any tooling that treats stored metadata as trusted SQL text: the injection payload persists inside the database object and only detonates when that serialized text is executed by a higher-privileged session.
Know when MariaDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H
PR:L because the attacker needs an account to create the poisoned object, AC:H and UI:R because a privileged operator must dump and re-apply the output, and S:C because injected SQL runs with the operator's higher authority.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Technical POC Analysis
Note on evidence: the supplied material is the GitHub advisory GHSA-wxr3-wm3p-7w6p plus five MDEV references (MDEV-39776, MDEV-39818, MDEV-40308, MDEV-40311, MDEV-40312).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A flaw in MariaDB Server allows an already-authenticated, low-privileged database user to plant hidden SQL statements inside schema objects, which then execute with full privileges when an administrator restores a dump or replays generated SQL. Because the payload only fires during routine backup/restore or migration workflows trusted by operations teams, the practical outcome is privileged database compromise and potential tampering with production data. Leadership should care because recovery processes - a core control for ransomware and disaster resilience - can be turned into an attack path, affecting any team that runs MariaDB 10.6 through 13.x with shared or multi-tenant database accounts.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
Exploit-DB