CVE-2026-107822 MariaDB CVE debrief

Who should care

MariaDB server administrators, security teams, and developers using MariaDB server should review and apply patches for affected versions, verify and restrict database privileges for users and roles, and monitor database activity for suspicious access attempts. Defenders should also verify database privileges and access controls, and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-107822 is a medium-severity vulnerability in MariaDB server that allows for database privilege escalation. Defenders should care because it could lead to unauthorized access to sensitive data or systems, and requires verification of database privileges and access controls, as well as patching or upgrading to fixed versions.

• Potential privilege escalation for attackers with CREATE USER privileges
• Possible unauthorized access to sensitive database data
• Need for verification of database privileges and access controls
• Requirement for patching or upgrading to fixed MariaDB server versions

Technical summary

A vulnerability in MariaDB server allows for database privilege escalation via user / role name collision in the acl cache. The issue affects versions 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. An attacker with CREATE USER privileges can create a colliding principal and exercise privileges assigned to the other account when the original principal's database privileges are cached. Defenders should review and apply patches for affected MariaDB server versions, verify and restrict database privileges for users and roles, and monitor database activity for suspicious access attempts.

Defensive priority

Medium priority for MariaDB server administrators and security teams

Recommended defensive actions

• Review and apply patches for affected MariaDB server versions
• Verify and restrict database privileges for users and roles
• Monitor database activity for suspicious access attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or victim impact. Defenders should verify database privileges and access controls, and review compensating controls for exposed systems while remediation is scheduled and verified. The vulnerability has a medium severity with a CVSS score of 6.4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.