High
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
Type: advisorySources: OSV
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-86047
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 17:32 UTC · Revision 1
Source evidence
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
core-osv · Original sourcePublished 16 Oct 2026, 16:37 UTC
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
osv:CVE-2026-86047
Complete source record
{
"id": "13876726ee4d4c29896ac12d67bea73984478c3e73c3af3f00ba678713b28547",
"url": "https://osv.dev/vulnerability/CVE-2026-86047",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "MariaDB: Insufficient quoting in mariadb-dump and SHOW commands",
"summary": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.",
"evidence": "osv:CVE-2026-86047",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-86047",
"aliases": [
"BIT-mariadb-2026-86047",
"BIT-mariadb-min-2026-86047",
"BIT-mysql-client-2026-86047",
"CVE-2026-86047",
"GHSA-wxr3-wm3p-7w6p"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mariadb/server",
"type": "GIT",
"events": [
{
"introduced": "00a8357bd30fdfca23720448a3f638290b6d35b7"
},
{
"fixed": "210ab6edf47fa73f3b77e974ed2e9357ccdd051c"
},
{
"introduced": "2437674291f31c91869a74eb6ebd9f03dc52bd43"
},
{
"fixed": "93e051860a9c7e87ee8cee6ed38b640d491f7170"
},
{
"introduced": "fa69b085b10f19a3a8b6e7adab27c104924333ae"
},
{
"fixed": "170b1d70737be6f134448f51713cdc1ae215b420"
},
{
"introduced": "1c4aed7c680c0402d6e97e097f03815c0e9bf4c5"
},
{
"fixed": "bf9193a939f515e95dd8def1a5468088c91cede6"
},
{
"introduced": "21a0714a118614982d20bfa504763d7247800091"
},
{
"fixed": "83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"
},
{
"introduced": "7f923870722c5d382e16d56af526d1ee4e03f987"
},
{
"fixed": "2b28d1c424104429eeed43115ee6d8a803671d52"
},
{
"fixed": "3646569225758c8225e7342783d775ef7c7570e5"
},
{
"fixed": "5acb43522863c9bd6b91f354104ea247bf513e9a"
},
{
"fixed": "9d4ffe23b25808f7858b2dc48106fbd60cf0e513"
},
{
"fixed": "d5d741a3076f911b468518d6b06a917593498c5b"
},
{
"fixed": "620a4b5624222048fece7fe1789978ae0675cae2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.6.1"
},
{
"fixed": "10.6.28"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.11.1"
},
{
"fixed": "10.11.19"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.4.1"
},
{
"fixed": "11.4.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.8.1"
},
{
"fixed": "11.8.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "12.3.1"
},
{
"fixed": "12.3.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "13.0.1"
},
{
"last_affected": "13.0.1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "2b28d1c424104429eeed43115ee6d8a803671d52"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "3646569225758c8225e7342783d775ef7c7570e5"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "5acb43522863c9bd6b91f354104ea247bf513e9a"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "9d4ffe23b25808f7858b2dc48106fbd60cf0e513"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d5d741a3076f911b468518d6b06a917593498c5b"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "93e051860a9c7e87ee8cee6ed38b640d491f7170"
}
],
"source": "REFERENCES_TAG",
"original_tag": "mariadb-10.11.19"
},
{
"range": [
{
"fixed": "210ab6edf47fa73f3b77e974ed2e9357ccdd051c"
}
],
"source": "REFERENCES_TAG",
"original_tag": "mariadb-10.6.28"
},
{
"range": [
{
"fixed": "170b1d70737be6f134448f51713cdc1ae215b420"
}
],
"source": "REFERENCES_TAG",
"original_tag": "mariadb-11.4.13"
},
{
"range": [
{
"fixed": "bf9193a939f515e95dd8def1a5468088c91cede6"
}
],
"source": "REFERENCES_TAG",
"original_tag": "mariadb-11.8.9"
},
{
"range": [
{
"fixed": "83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"
}
],
"source": "REFERENCES_TAG",
"original_tag": "mariadb-12.3.3"
},
{
"range": [
{
"fixed": "620a4b5624222048fece7fe1789978ae0675cae2"
}
],
"source": "REFERENCES_TAG",
"original_tag": "mariadb-13.0.2"
}
]
}
}
],
"versions": [
"13.0.1",
"mariadb-13.0.1",
"mariadb-10.6.27",
"mariadb-11.8.7b",
"mariadb-11.4.11b",
"mariadb-10.6.26",
"mariadb-11.8.7",
"mariadb-11.4.11",
"mariadb-12.3.1",
"mariadb-11.8.6",
"mariadb-11.4.10",
"mariadb-10.6.25",
"mariadb-11.8.4",
"mariadb-11.4.9",
"mariadb-10.6.24",
"mariadb-11.8.3",
"mariadb-10.6.23",
"mariadb-11.4.8",
"mariadb-11.8.2",
"mariadb-10.6.20",
"mariadb-11.4.7",
"mariadb-10.6.5",
"mariadb-11.4.6",
"mariadb-10.6.22",
"mariadb-11.8.1",
"mariadb-11.4.5",
"mariadb-10.6.21",
"mariadb-11.4.4",
"mariadb-10.6.18",
"mariadb-11.4.3",
"mariadb-10.6.19",
"mariadb-10.6.17",
"mariadb-11.4.2",
"mariadb-11.4.1",
"mariadb-10.6.16",
"mariadb-10.6.12",
"mariadb-10.6.14",
"mariadb-10.6.13",
"mariadb-10.6.11",
"mariadb-10.6.8",
"mariadb-10.6.9",
"mariadb-10.6.10",
"mariadb-10.6.6",
"mariadb-10.6.4",
"mariadb-10.6.3",
"mariadb-10.6.2",
"mariadb-10.6.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86047.json"
}
}
],
"modified": "2026-10-28T02:30:21.545726014Z",
"provider": "osv",
"references": [
"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"https://jira.mariadb.org/browse/MDEV-39776",
"https://jira.mariadb.org/browse/MDEV-39818",
"https://jira.mariadb.org/browse/MDEV-40308",
"https://jira.mariadb.org/browse/MDEV-40311",
"https://jira.mariadb.org/browse/MDEV-40312",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86047.json",
"https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p",
"https://nvd.nist.gov/vuln/detail/CVE-2026-86047",
"https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52",
"https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5",
"https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a",
"https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513",
"https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b"
],
"provider_metadata": {
"cwe_ids": [
"CWE-89"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86047.json"
}
},
"related_cves": [
{
"value": "CVE-2026-86047",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 487818,
"published_at": "2026-10-16T16:37:04.254+00:00"
}