CVE-2026-107822
- Source
- https://cve.org/CVERecord?id=CVE-2026-107822
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-107822.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-107822
- Aliases
-
- BIT-mariadb-2026-107822
- BIT-mariadb-min-2026-107822
- BIT-mysql-client-2026-107822
- GHSA-2m85-2x26-36rf
- Downstream
BELL (1)
DEBIAN (1)
ECHO (1)
MINI (6)
RHSA (2)
UBUNTU (1)
- Published
- 2026-10-09T17:28:47Z
- Modified
- 2026-10-22T16:30:44Z
- Severity
-
- 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- MariaDB: database privilege escalation via user / role name collision in the acl cache
- Details
-
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-706", "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107822.json" }- References
-
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
- https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
- https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2
- https://jira.mariadb.org/browse/MDEV-40541
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107822.json
- https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf
- https://nvd.nist.gov/vuln/detail/CVE-2026-107822
- https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b
Affected packages
Git / github.com/mariadb/server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mariadb/server
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "range": [ { "introduced": "10.6.1" }, { "fixed": "10.6.28" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "range": [ { "introduced": "10.11.1" }, { "fixed": "10.11.19" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "range": [ { "introduced": "11.4.1" }, { "fixed": "11.4.13" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "range": [ { "introduced": "11.8.1" }, { "fixed": "11.8.9" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.3.1" }, { "fixed": "12.3.3" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "range": [ { "introduced": "13.0.1" }, { "fixed": "13.0.2" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "67ea07dd3400004e4f7ae01bf977f4344bbe064b" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "mariadb-10.11.19", "range": [ { "fixed": "93e051860a9c7e87ee8cee6ed38b640d491f7170" } ], "source": "REFERENCES_TAG" }, { "original_tag": "mariadb-10.6.28", "range": [ { "fixed": "210ab6edf47fa73f3b77e974ed2e9357ccdd051c" } ], "source": "REFERENCES_TAG" }, { "original_tag": "mariadb-11.4.13", "range": [ { "fixed": "170b1d70737be6f134448f51713cdc1ae215b420" } ], "source": "REFERENCES_TAG" }, { "original_tag": "mariadb-11.8.9", "range": [ { "fixed": "bf9193a939f515e95dd8def1a5468088c91cede6" } ], "source": "REFERENCES_TAG" }, { "original_tag": "mariadb-12.3.3", "range": [ { "fixed": "83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e" } ], "source": "REFERENCES_TAG" }, { "original_tag": "mariadb-13.0.2", "range": [ { "fixed": "620a4b5624222048fece7fe1789978ae0675cae2" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
mariadb-10.*
mariadb-10.6.1
mariadb-10.6.10
mariadb-10.6.11
mariadb-10.6.12
mariadb-10.6.13
mariadb-10.6.14
mariadb-10.6.16
mariadb-10.6.17
mariadb-10.6.18
mariadb-10.6.19
mariadb-10.6.2
mariadb-10.6.20
mariadb-10.6.21
mariadb-10.6.22
mariadb-10.6.23
mariadb-10.6.24
mariadb-10.6.25
mariadb-10.6.26
mariadb-10.6.27
mariadb-10.6.3
mariadb-10.6.4
mariadb-10.6.5
mariadb-10.6.6
mariadb-10.6.8
mariadb-10.6.9
mariadb-11.*
mariadb-11.4.1
mariadb-11.4.10
mariadb-11.4.11
mariadb-11.4.11b
mariadb-11.4.2
mariadb-11.4.3
mariadb-11.4.4
mariadb-11.4.5
mariadb-11.4.6
mariadb-11.4.7
mariadb-11.4.8
mariadb-11.4.9
mariadb-11.8.1
mariadb-11.8.2
mariadb-11.8.3
mariadb-11.8.4
mariadb-11.8.6
mariadb-11.8.7
mariadb-11.8.7b
mariadb-12.*
mariadb-12.3.1
mariadb-13.*
mariadb-13.0.1
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-107822.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "339712868486696881928202886484344029960",
"length": 1715
},
"id": "CVE-2026-107822-1cd3e8db",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e",
"target": {
"file": "sql/log_event_server.cc",
"function": "Rows_log_event_fragmenter::fragment"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"265577632303887446289749120585557906012",
"90338461107598051749602183626527029076",
"135974257990159682542061181314070611477",
"59440921527566409168742990730026725636",
"871135494022066138858656571240698570",
"247293449498909397416026347351022219912",
"179396894775406735805665784479451940140",
"269443033021460921618747189093528286356",
"259691733175197008076763079871985256069",
"102338916828131457031608538914692707050",
"65381815336936246662830619643818353906",
"7100122396357284882133944108516856108",
"161393146120866756988306743699529625075"
],
"threshold": 0.9
},
"id": "CVE-2026-107822-6d62851c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6",
"target": {
"file": "sql/item_vectorfunc.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"294187237149416057080918645267222402135",
"283055354525272166759678965421068218151",
"134811447781922216158747182151740728947",
"175341161064196556624033445047087766879"
],
"threshold": 0.9
},
"id": "CVE-2026-107822-be6884b1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b",
"target": {
"file": "sql/sql_acl.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "73617688475456381632237133958511949829",
"length": 361
},
"id": "CVE-2026-107822-c0933a1f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6",
"target": {
"file": "sql/item_vectorfunc.cc",
"function": "Item_func_vec_fromtext::fix_length_and_dec"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "218189371449465772794356865534982211923",
"length": 1856
},
"id": "CVE-2026-107822-cffe9670",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b",
"target": {
"file": "sql/sql_acl.cc",
"function": "acl_get"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"171922335289695664967320282302097012127",
"314879264303882873216162120692739820747",
"296657960952465744719770094395708912555",
"28908880241426286725700820784852115102"
],
"threshold": 0.9
},
"id": "CVE-2026-107822-e432b228",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e",
"target": {
"file": "sql/log_event_server.cc"
}
}
]
vanir_signatures_modified
"2026-10-22T16:30:44Z"