CVE-2026-97380: MariaDB GRANT PROXY Privilege Escalation Due to Empty Password Misconfiguration
Summary
CVE-2026-97380: MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges. Affects mariadb across 6 version ranges.
>= 10.6.1, < 10.6.28
>= 10.11.1, < 10.11.19
>= 11.4.1, < 11.4.13
>= 11.8.1, < 11.8.9
>= 12.3.1, < 12.3.3
>= 13.0.1, < 13.0.2
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- mysql-client · Bitnami
- mariadb-min · Bitnami
The same CVE-2026-97380 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is a community-developed fork of the MySQL server, designed to be a drop-in replacement with enhanced features and performance. It is widely used for database management due to its reliability, scalability, and rich functionality. However, certain versions of MariaDB are vulnerable to a privilege escalation issue when using the GRANT PROXY statement with an empty password, which can lead to unauthorized access and manipulation of user accounts.
Vulnerability Detail
The vulnerability arises in MariaDB versions 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the GRANT PROXY statement incorrectly treats an IDENTIFIED clause with an empty password as if no authentication is specified. This flaw allows a low-privileged attacker to exploit the authorization error by naming another account and setting that account's password, potentially leading to unauthorized access and control over the database.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.6.1, < 10.6.2810.6.28 -
>= 10.11.1, < 10.11.1910.11.19 -
>= 11.4.1, < 11.4.1311.4.13 -
>= 11.8.1, < 11.8.911.8.9 -
>= 12.3.1, < 12.3.312.3.3 -
>= 13.0.1, < 13.0.213.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the GRANT PROXY statement with an empty password until the package is updated. Ensure that all user accounts have strong, non-empty passwords to mitigate the risk of unauthorized access.
Conclusion
The vulnerability CVE-2026-97380 poses a significant risk to MariaDB users, allowing unauthorized access through misconfigured GRANT PROXY statements. It is imperative to update to the latest patched versions and implement strong password policies to safeguard your database.
See every vulnerability recorded for mariadb →
FAQ
CVE-2026-97380 is a vulnerability in MariaDB that allows low-privileged attackers to exploit the GRANT PROXY statement with an empty password, leading to potential unauthorized access.
The affected versions include MariaDB 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Update your MariaDB installation to a patched version and ensure that all user accounts have strong passwords.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software using a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
