CVE-2026-86047: MariaDB Insufficient Quoting Vulnerability in mariadb-dump and SHOW Commands
Summary
CVE-2026-86047: MariaDB: Insufficient quoting in mariadb-dump and SHOW commands. Affects mariadb across 6 version ranges.
>= 10.6.1, < 10.6.28
>= 10.11.1, < 10.11.19
>= 11.4.1, < 11.4.13
>= 11.8.1, < 11.8.9
>= 12.3.1, < 12.3.3
>= 13.0.1, < 13.0.2
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- mysql-client · Bitnami
- mariadb-min · Bitnami
The same CVE-2026-86047 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is a community-developed fork of the MySQL server, designed to be a drop-in replacement for MySQL with additional features and optimizations. It is widely used for managing relational databases and supports various storage engines. However, certain versions of MariaDB are vulnerable to a security issue that affects the way identifiers and values are quoted in SQL commands, potentially allowing for SQL injection attacks.
Vulnerability Detail
The vulnerability arises from insufficient quoting in the mariadb-dump and SHOW commands, specifically in the functions SHOW CREATE SERVER and SHOW CREATE USER. This issue affects versions 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. A low-privileged attacker can exploit this vulnerability by creating objects with crafted identifiers or values that are included in the output of SHOW commands or dumps. If this output is then applied, it can lead to the execution of attacker-injected SQL statements, compromising the database's integrity and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.6.1, < 10.6.2810.6.28 -
>= 10.11.1, < 10.11.1910.11.19 -
>= 11.4.1, < 11.4.1311.4.13 -
>= 11.8.1, < 11.8.911.8.9 -
>= 12.3.1, < 12.3.312.3.3 -
>= 13.0.1, < 13.0.213.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the affected SHOW commands and mariadb-dump until the package is updated to a secure version. Additionally, review and sanitize any identifiers or values that are used in SQL commands to mitigate the risk of injection.
Conclusion
The CVE-2026-86047 vulnerability in MariaDB highlights the importance of proper quoting in SQL commands to prevent SQL injection attacks. Users are strongly advised to update to the latest patched versions to secure their databases against potential exploitation.
See every vulnerability recorded for mariadb →
FAQ
The affected versions include 10.6.1 to 10.6.28, 10.11.1 to 10.11.19, 11.4.1 to 11.4.13, 11.8.1 to 11.8.9, 12.3.1 to 12.3.3, and 13.0.1 to 13.0.2.
An attacker could execute arbitrary SQL commands, potentially compromising the database's integrity and allowing unauthorized access to sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, avoid using the affected SHOW commands and sanitize any identifiers or values used in SQL commands to reduce the risk of SQL injection.
More details can be found in the official vulnerability database or the GitHub repository linked in the database-specific section.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
