CVE-2026-107822mediumCWE-706CWE-863

CVE-2026-107822: medium-severity vulnerability in MariaDB server

MariaDB: database privilege escalation via user / role name collision in the acl cache

Published · Updated

Follow this CVE+ Monitor server+ Monitor mariadb

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 0.5%
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
MariaDB · server
Related CVEs — MariaDB server

In the same product, most dangerous first.

CVE-2026-49261CRITICALMariaDB server has unsafe parameter handling in `wsrep_notify_cmd`EPSS 1.6%CVE-2026-48165HIGHMariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner sideEPSS 1.5%CVE-2026-92262CRITICALMariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.EPSS 1.5%CVE-2026-107815HIGHMariaDB: one byte OOB write in DOS tables of the CONNECT engineEPSS 1.4%CVE-2026-44170MEDIUMMariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URLEPSS 1.3%CVE-2026-97380HIGHMariaDB: GRANT PROXY with empty password incorrectly checks grantor's privilegesEPSS 1.3%