CVE-2026-86047
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-86047- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2026-102943
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
EUVD-2026-102943- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H - Updated
- 2026-11-02
NVD
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-86047- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVBELL-CVE-2026-86047
- Record
BELL-CVE-2026-86047- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H - Updated
- 2026-11-02
OSV
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-86047- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-86047
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
DEBIAN-CVE-2026-86047- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVRHSA-2026:84689
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:84689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:84701
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:84701- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-86047
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
UBUNTU-CVE-2026-86047- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H - Updated
- 2026-11-02
OSVBIT-mariadb-2026-86047 No score
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mariadb-2026-86047- Updated
- 2026-11-02
OSVBIT-mariadb-min-2026-86047 No score
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mariadb-min-2026-86047- Updated
- 2026-11-02
OSVBIT-mysql-client-2026-86047 No score
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mysql-client-2026-86047- Updated
- 2026-11-02
OSVCLSA-2026-1792636681 No score
mariadb: Fix of 6 CVEs
- CVE-2026-86047: quote identifiers and values in SHOW CREATE TABLE/USER, SHOW GRANTS, mariadb-dump, mariadb-show and mariadb-convert-table-format
- CVE-2026-92262: refuse #mysql50# names that mix up with table names in the table cache and on disk
- CVE-2026-85746: fix heap buffer overflow in ST_AsText() for nested geometry collections
- Record
CLSA-2026-1792636681- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12245-1 No score
libmariadbd-devel-12.3.2-3.1 on GA media
These are all security issues fixed in the libmariadbd-devel-12.3.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12245-1- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-86047 No score
CVE-2026-86047 in mariadb - Patched by Root
Root has patched CVE-2026-86047 in the mariadb package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-86047- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-86047 No score
CVE-2026-86047 in mariadb - Patched by Root
Root has patched CVE-2026-86047 in the mariadb package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-86047- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mariadbAlpaquita:23 |
10.6.12-r0 up to 10.6.28-r0 | 10.6.28-r0 |
mariadbAlpaquita:25 |
11.4.5-r0 up to 11.4.13-r0 | 11.4.13-r0 |
mariadbAlpaquita:stream |
10.11.4-r0 up to 11.8.9-r0 | 11.8.9-r0 |
mariadbBitnami |
10.6.1 up to 10.6.28, 10.11.0 up to 10.11.19, 11.4.0 up to 11.4.13, 11.8.0 up to 11.8.9, 12.3.0 up to 12.3.3, 13.0.0 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mariadb-minBitnami |
10.6.1 up to 10.6.28, 10.11.0 up to 10.11.19, 11.4.0 up to 11.4.13, 11.8.0 up to 11.8.9, 12.3.0 up to 12.3.3, 13.0.0 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mysql-clientBitnami |
10.6.1 up to 10.6.28, 10.11.0 up to 10.11.19, 11.4.0 up to 11.4.13, 11.8.0 up to 11.8.9, 12.3.0 up to 12.3.3, 13.0.0 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mariadbTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-backupTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-commonTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-develTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
Show 66 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mariadb-embeddedTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-embedded-develTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-errmsgTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-gssapi-serverTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-oqgraph-engineTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-pamTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-serverTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-server-galeraTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-server-utilsTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadb-testTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 | 3:10.5.29-1.el9_2.alma.1.tuxcare.els6 |
mariadbDebian:12 |
All versions, plus listed versions 1:10.11.11-0+deb12u11:10.11.13-0+deb12u11:10.11.14-0+deb12u11:10.11.14-0+deb12u21:10.11.18-0+deb12u1 Show 45 moreShow less1:10.11.19-0+deb12u11:10.11.3-11:10.11.3-2~exp11:10.11.4-11:10.11.4-1~deb12u11:10.11.5-11:10.11.5-21:10.11.5-31:10.11.6-0+deb12u11:10.11.6-11:10.11.6-21:10.11.6-2.1~exp11:10.11.7-11:10.11.7-21:10.11.7-31:10.11.7-41:10.11.8-11:10.11.9-0+deb12u11:11.4.2-11:11.4.2-21:11.4.2-31:11.4.2-41:11.4.3-11:11.4.4-11:11.4.4-21:11.4.4-31:11.4.5-11:11.4.5-2~exp11:11.8.1-11:11.8.1-21:11.8.1-31:11.8.1-41:11.8.1-51:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-3 |
None known |
mariadbDebian:13 |
All versions, plus listed versions 1:11.8.2-11:11.8.3-0+deb13u11:11.8.3-11:11.8.5-11:11.8.5-2 Show 18 moreShow less1:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-0+deb13u11:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-0+deb13u11:11.8.8-11:11.8.9+ds-11:11.8.9+ds-21:11.8.9+ds-31:11.8.9+ds-4 |
None known |
mariadbDebian:14 |
before 1:11.8.9+ds-1, plus listed versions 1:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-3 Show 11 moreShow less1:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-1 |
1:11.8.9+ds-1 |
mariadb11.8Red Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-backupRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-client-utilsRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-commonRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-connect-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-cracklib-password-checkRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-develRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-duckdb-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-embeddedRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-embedded-develRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-errmsgRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-gssapi-serverRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-oqgraph-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-pamRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-rocksdb-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-s3-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-serverRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-server-galeraRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-server-utilsRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-sphinx-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-testRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb10.11Red Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-backupRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-client-utilsRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-commonRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-connect-engineRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-cracklib-password-checkRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-develRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-embeddedRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-embedded-develRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-errmsgRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-gssapi-serverRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-oqgraph-engineRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-pamRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-rocksdb-engineRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-s3-engineRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-serverRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-server-galeraRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-server-utilsRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-sphinx-engineRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadb10.11-testRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:10.11.18-4.1.1.hum1 | 0:10.11.18-4.1.1.hum1 |
mariadbRoot:Debian:12 |
before 1:10.11.19-0+deb12u1.aikido.13 | 1:10.11.19-0+deb12u1.aikido.13 |
rootio-mariadbRoot:Debian:12 |
before 1:10.11.19-0+deb12u1.aikido.13 | 1:10.11.19-0+deb12u1.aikido.13 |
mariadbRoot:Debian:13 |
before 1:11.8.6-0+deb13u1.aikido.11 | 1:11.8.6-0+deb13u1.aikido.111:11.8.6-0+deb13u1.aikido.12 |
rootio-mariadbRoot:Debian:13 |
before 1:11.8.6-0+deb13u1.aikido.11 | 1:11.8.6-0+deb13u1.aikido.111:11.8.6-0+deb13u1.aikido.12 |
mariadb-10.0Ubuntu:16.04:LTS |
All versions, plus listed versions 10.0.20-0ubuntu0.15.04.110.0.22-0ubuntu110.0.23-110.0.23-210.0.24-7 Show 9 moreShow less10.0.25-0ubuntu0.16.04.110.0.27-0ubuntu0.16.04.110.0.28-0ubuntu0.16.04.110.0.29-0ubuntu0.16.04.110.0.31-0ubuntu0.16.04.210.0.33-0ubuntu0.16.04.110.0.34-0ubuntu0.16.04.110.0.36-0ubuntu0.16.04.110.0.38-0ubuntu0.16.04.1 |
None known |
mariadb-10.1Ubuntu:18.04:LTS |
All versions, plus listed versions 10.1.25-11:10.1.29-61:10.1.34-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.2 Show 6 moreShow less1:10.1.40-0ubuntu0.18.04.11:10.1.41-0ubuntu0.18.04.11:10.1.43-0ubuntu0.18.04.11:10.1.44-0ubuntu0.18.04.11:10.1.47-0ubuntu0.18.04.11:10.1.48-0ubuntu0.18.04.1 |
None known |
mariadb-10.3Ubuntu:20.04:LTS |
All versions, plus listed versions 1:10.3.17-11:10.3.18-11:10.3.19-11:10.3.21-21:10.3.22-1 Show 10 moreShow less1:10.3.22-1ubuntu11:10.3.25-0ubuntu0.20.04.11:10.3.29-0ubuntu0.20.04.11:10.3.30-0ubuntu0.20.04.11:10.3.31-0ubuntu0.20.04.11:10.3.32-0ubuntu0.20.04.11:10.3.34-0ubuntu0.20.04.11:10.3.37-0ubuntu0.20.04.11:10.3.38-0ubuntu0.20.04.11:10.3.39-0ubuntu0.20.04.2 |
None known |
mariadb-10.6Ubuntu:22.04:LTS |
All versions, plus listed versions 1:10.6.7-2ubuntu11:10.6.7-2ubuntu1.11:10.6.11-0ubuntu0.22.04.11:10.6.12-0ubuntu0.22.04.11:10.6.16-0ubuntu0.22.04.1 Show 4 moreShow less1:10.6.18-0ubuntu0.22.04.11:10.6.21-0ubuntu0.22.04.21:10.6.22-0ubuntu0.22.04.11:10.6.23-0ubuntu0.22.04.1 |
None known |
mariadbUbuntu:24.04:LTS |
All versions, plus listed versions 1:10.11.4-11:10.11.5-31:10.11.6-11:10.11.6-21:10.11.7-2ubuntu1 Show 5 moreShow less1:10.11.7-2ubuntu21:10.11.8-0ubuntu0.24.04.11:10.11.11-0ubuntu0.24.04.21:10.11.13-0ubuntu0.24.04.11:10.11.14-0ubuntu0.24.04.1 |
None known |
mariadbUbuntu:26.10 |
All versions, plus listed versions 1:11.8.6-51:11.8.8-11:11.8.9+ds-4ubuntu2 |
None known |
mariadbUbuntu:26.04:LTS |
All versions, plus listed versions 1:11.8.3-1build11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-4 Show 5 moreShow less1:11.8.6-11:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-5ubuntu0.1 |
None known |
mariadbopenSUSE:Tumbleweed From an advisory covering 22 CVEs |
before 12.3.2-3.1 | 12.3.2-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-86047 is a high vulnerability (CVSS 7.7) in Devolutions Server, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in mariadb 10.6.28-r0.
References
github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p
Show 125 moreShow less
jira.mariadb.org/browse/MDEV-39776
docs.bell-sw.com/security/cves/CVE-2026-86047
nvd.nist.gov/vuln/detail/CVE-2026-86047
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792636681.html
security-tracker.debian.org/tracker/CVE-2026-86047
access.redhat.com/errata/RHSA-2026:84689
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84689.json
bugzilla.redhat.com/show_bug.cgi?id=2553280
cve.org/CVERecord?id=CVE-2026-85745
hackerone.com/reports/3856148
ubuntu.com/security/CVE-2026-86047
suse.com/security/cve/CVE-2026-102523
Left out here: 8 versions. The JSON record has them.