CVE-2026-107822·MariaDB vulnerability
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Severity
- medium
- Software
- MariaDB
- Fixed in
- 13.0.2
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.30% — higher than 20% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 13.0.1
Until: 13.0.2
Fixed in: 13.0.2
How to fix this CVE
Update MariaDB to version 11.8.9 or later to fix an ACL cache collision vulnerability that allows privilege escalation. Users with CREATE USER permissions could exploit a hash collision between role and localhost user entries to gain unauthorized database privileges. Apply the update immediately across all affected MariaDB instances to prevent unauthorized access.
sudo dnf update mariadb-serverDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check installed MariaDB version with: mysql --version or mariadb --version
- Step 2: Query MariaDB for the exact version and build: SELECT VERSION(); from the MariaDB client
- Step 3: Review user and role tables for suspicious entries: SELECT * FROM mysql.user WHERE User IN (SELECT DISTINCT FROM_USER FROM mysql.roles_mapping);
- Step 4: After patching, verify the new version is running: systemctl restart mariadb && mysql --version
FAQ
What is CVE-2026-107822?
A privilege escalation vulnerability in MariaDB's access control list (ACL) cache where role names and localhost user accounts could generate identical cache keys due to empty IP components, allowing attackers with CREATE USER privileges to impersonate other accounts and gain their database permissions.
Is CVE-2026-107822 being actively exploited?
No, this vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available, though the attack requires valid database CREATE USER permissions.
What versions of MariaDB are affected by CVE-2026-107822?
MariaDB versions 10.6.1 through 10.6.27, 10.11.0 through 10.11.18, 11.4.0 through 11.4.12, 11.8.0 through 11.8.8, 12.3.0 through 12.3.2, and 13.0.0 through 13.0.1 are vulnerable.
How do I check if my server is vulnerable to CVE-2026-107822?
Run mariadb --version to check your installed version, then compare it against the vulnerable ranges above; any version below 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 respectively is vulnerable.
Does Defensia detect CVE-2026-107822?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-107822 will appear in your dashboard with remediation steps.
Related MariaDB CVEs
References
- https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-107822. Free for 1 server.
Get started free