CVE-2026-107822
MariaDB: database privilege escalation via user / role name collision in the acl cache
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
MariaDB: database privilege escalation via user / role name collision in the acl cache
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-107822- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-706, CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-95922
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
EUVD-2026-95922- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-107822- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-706, CWE-863
- Updated
- 2026-11-02
OSVBELL-CVE-2026-107822
- Record
BELL-CVE-2026-107822- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
MariaDB: database privilege escalation via user / role name collision in the acl cache
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-107822- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-706, CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-107822
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
DEBIAN-CVE-2026-107822- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVRHSA-2026:83108
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:83108- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:84689
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:84689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-107822
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
UBUNTU-CVE-2026-107822- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-mariadb-2026-107822 No score
MariaDB: database privilege escalation via user / role name collision in the acl cache
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mariadb-2026-107822- Updated
- 2026-11-02
OSVBIT-mariadb-min-2026-107822 No score
MariaDB: database privilege escalation via user / role name collision in the acl cache
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mariadb-min-2026-107822- Updated
- 2026-11-02
OSVBIT-mysql-client-2026-107822 No score
MariaDB: database privilege escalation via user / role name collision in the acl cache
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mysql-client-2026-107822- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12245-1 No score
libmariadbd-devel-12.3.2-3.1 on GA media
These are all security issues fixed in the libmariadbd-devel-12.3.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12245-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mariadbAlpaquita:23 |
10.6.12-r0 up to 10.6.28-r0 | 10.6.28-r0 |
mariadbAlpaquita:25 |
11.4.5-r0 up to 11.4.13-r0 | 11.4.13-r0 |
mariadbAlpaquita:stream |
10.11.4-r0 up to 11.8.9-r0 | 11.8.9-r0 |
mariadbBitnami |
10.6.1 up to 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, 13.0.1 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mariadb-minBitnami |
10.6.1 up to 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, 13.0.1 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mysql-clientBitnami |
10.6.1 up to 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, 13.0.1 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mariadbDebian:12 |
All versions, plus listed versions 1:10.11.11-0+deb12u11:10.11.13-0+deb12u11:10.11.14-0+deb12u11:10.11.14-0+deb12u21:10.11.18-0+deb12u1 Show 45 moreShow less1:10.11.19-0+deb12u11:10.11.3-11:10.11.3-2~exp11:10.11.4-11:10.11.4-1~deb12u11:10.11.5-11:10.11.5-21:10.11.5-31:10.11.6-0+deb12u11:10.11.6-11:10.11.6-21:10.11.6-2.1~exp11:10.11.7-11:10.11.7-21:10.11.7-31:10.11.7-41:10.11.8-11:10.11.9-0+deb12u11:11.4.2-11:11.4.2-21:11.4.2-31:11.4.2-41:11.4.3-11:11.4.4-11:11.4.4-21:11.4.4-31:11.4.5-11:11.4.5-2~exp11:11.8.1-11:11.8.1-21:11.8.1-31:11.8.1-41:11.8.1-51:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-3 |
None known |
mariadbDebian:13 |
All versions, plus listed versions 1:11.8.2-11:11.8.3-0+deb13u11:11.8.3-11:11.8.5-11:11.8.5-2 Show 18 moreShow less1:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-0+deb13u11:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-0+deb13u11:11.8.8-11:11.8.9+ds-11:11.8.9+ds-21:11.8.9+ds-31:11.8.9+ds-4 |
None known |
mariadbDebian:14 |
before 1:11.8.9+ds-1, plus listed versions 1:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-3 Show 11 moreShow less1:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-1 |
1:11.8.9+ds-1 |
mariadb10.11Red Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
Show 48 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mariadb10.11-backupRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-client-utilsRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-commonRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-connect-engineRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-cracklib-password-checkRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-develRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-embeddedRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-embedded-develRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-errmsgRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-gssapi-serverRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-oqgraph-engineRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-pamRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-rocksdb-engineRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-s3-engineRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-serverRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-server-galeraRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-server-utilsRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-sphinx-engineRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-testRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb11.8Red Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-backupRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-client-utilsRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-commonRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-connect-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-cracklib-password-checkRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-develRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-duckdb-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-embeddedRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-embedded-develRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-errmsgRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-gssapi-serverRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-oqgraph-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-pamRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-rocksdb-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-s3-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-serverRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-server-galeraRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-server-utilsRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-sphinx-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-testRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb-10.0Ubuntu:16.04:LTS |
All versions, plus listed versions 10.0.20-0ubuntu0.15.04.110.0.22-0ubuntu110.0.23-110.0.23-210.0.24-7 Show 9 moreShow less10.0.25-0ubuntu0.16.04.110.0.27-0ubuntu0.16.04.110.0.28-0ubuntu0.16.04.110.0.29-0ubuntu0.16.04.110.0.31-0ubuntu0.16.04.210.0.33-0ubuntu0.16.04.110.0.34-0ubuntu0.16.04.110.0.36-0ubuntu0.16.04.110.0.38-0ubuntu0.16.04.1 |
None known |
mariadb-10.1Ubuntu:18.04:LTS |
All versions, plus listed versions 10.1.25-11:10.1.29-61:10.1.34-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.2 Show 6 moreShow less1:10.1.40-0ubuntu0.18.04.11:10.1.41-0ubuntu0.18.04.11:10.1.43-0ubuntu0.18.04.11:10.1.44-0ubuntu0.18.04.11:10.1.47-0ubuntu0.18.04.11:10.1.48-0ubuntu0.18.04.1 |
None known |
mariadb-10.3Ubuntu:20.04:LTS |
All versions, plus listed versions 1:10.3.17-11:10.3.18-11:10.3.19-11:10.3.21-21:10.3.22-1 Show 10 moreShow less1:10.3.22-1ubuntu11:10.3.25-0ubuntu0.20.04.11:10.3.29-0ubuntu0.20.04.11:10.3.30-0ubuntu0.20.04.11:10.3.31-0ubuntu0.20.04.11:10.3.32-0ubuntu0.20.04.11:10.3.34-0ubuntu0.20.04.11:10.3.37-0ubuntu0.20.04.11:10.3.38-0ubuntu0.20.04.11:10.3.39-0ubuntu0.20.04.2 |
None known |
mariadb-10.6Ubuntu:22.04:LTS |
All versions, plus listed versions 1:10.6.7-2ubuntu11:10.6.7-2ubuntu1.11:10.6.11-0ubuntu0.22.04.11:10.6.12-0ubuntu0.22.04.11:10.6.16-0ubuntu0.22.04.1 Show 4 moreShow less1:10.6.18-0ubuntu0.22.04.11:10.6.21-0ubuntu0.22.04.21:10.6.22-0ubuntu0.22.04.11:10.6.23-0ubuntu0.22.04.1 |
None known |
mariadbUbuntu:24.04:LTS |
All versions, plus listed versions 1:10.11.4-11:10.11.5-31:10.11.6-11:10.11.6-21:10.11.7-2ubuntu1 Show 5 moreShow less1:10.11.7-2ubuntu21:10.11.8-0ubuntu0.24.04.11:10.11.11-0ubuntu0.24.04.21:10.11.13-0ubuntu0.24.04.11:10.11.14-0ubuntu0.24.04.1 |
None known |
mariadbUbuntu:26.10 |
All versions, plus listed versions 1:11.8.6-51:11.8.8-11:11.8.9+ds-4ubuntu2 |
None known |
mariadbUbuntu:26.04:LTS |
All versions, plus listed versions 1:11.8.3-1build11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-4 Show 5 moreShow less1:11.8.6-11:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-5ubuntu0.1 |
None known |
mariadbopenSUSE:Tumbleweed From an advisory covering 22 CVEs |
before 12.3.2-3.1 | 12.3.2-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107822 is a medium vulnerability (CVSS 6.4) in Devolutions Server, published October 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in mariadb 10.6.28-r0.
References
github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf
Show 122 moreShow less
jira.mariadb.org/browse/MDEV-40541
docs.bell-sw.com/security/cves/CVE-2026-107822
nvd.nist.gov/vuln/detail/CVE-2026-107822
security-tracker.debian.org/tracker/CVE-2026-107822
access.redhat.com/errata/RHSA-2026:83108
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83108.json
bugzilla.redhat.com/show_bug.cgi?id=2548712
cve.org/CVERecord?id=CVE-2026-107814
hackerone.com/reports/3856148
ubuntu.com/security/CVE-2026-107822
suse.com/security/cve/CVE-2026-102523
Left out here: 8 versions. The JSON record has them.