MariaDB Server CVE-2026-97380

Requires an authenticated attacker holding any low-privileged MariaDB account (PR:L) on a server running an affected version (10.6.1 through the versions just before 10.6.28/10.11.19/11.4.13/11.8.9/12.3.3/13.0.2). The specific trigger is a GRANT PROXY statement using an IDENTIFIED/IDENTIFIED VIA clause with an EMPTY password, which the server wrongly interprets as 'no authentication specified' and then evaluates against the incorrect grantor's privileges. The attacker must be able to name the target account they wish to hijack. LIMITING FACTORS: exploitation is impossible for fully unauthenticated users (a valid login is mandatory), the empty-IDENTIFIED-clause code path must be reached, and the impact depends on which account the attacker targets - hijacking a high-privilege account yields full compromise while targeting an equally low account yields little gain. No user interaction is required (UI:N).

This is a genuine high-priority issue, though its real-world urgency is tempered by the authentication requirement. The CVSS vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only a low-privileged authenticated database account, with C:H/I:H/A:H reflecting that an attacker who resets a high-privileged account's password achieves full account takeover and thus total database compromise. The authorization-logic nature of the bug (GRANT PROXY with an empty IDENTIFIED clause checking the wrong grantor's privileges) makes exploitation deterministic rather than probabilistic once an attacker has any valid login and can name a target account. However, several escalation signals are MISSING from the provided data: no EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation status is 'no public exploit identified at time of analysis' - this is NOT evidence of active exploitation, only absence of that intelligence in the inputs. The CVSS C:H rating is slightly generous given the core defect is an integrity/authorization failure (CWE-620, unverified password change) rather than direct data disclosure; confidentiality impact is consequential (achieved only after account takeover), not primary. Net: a real priority for any multi-tenant or shared MariaDB deployment where untrusted users hold accounts, but the PR:L gate means it is not a mass-internet-exploitable unauthenticated bug.

A low-privileged user with a legitimate account on a shared MariaDB server issues a GRANT PROXY statement naming a higher-privileged target account with an empty IDENTIFIED VIA '' clause; the server mistakenly treats this as no authentication specified and checks the wrong grantor's privileges, allowing the attacker to set the target account's password. The attacker then logs in as that privileged account and takes over the database. No public exploit was identified in the provided data, though the vendor's fix commit and regression test are published.