CVE-2026-102523
MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
CVE-2026-102523 is a high vulnerability (CVSS 8.0) in Devolutions Server, published October 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in mariadb 11.4.13-r0.
- Severity
- 8.0 HighCVSS 3.1, CVE List
- Exploit chance
- 0.75%EPSS, 55th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
11.4.13-r0mariadb +31 more
Description
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Discussion
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mariadbAlpaquita:25 | 11.4.5-r0 up to 11.4.13-r0 | 11.4.13-r0 |
mariadbDebian:12 | All versions, plus listed versions 1:10.11.11-0+deb12u11:10.11.13-0+deb12u11:10.11.14-0+deb12u11:10.11.14-0+deb12u21:10.11.18-0+deb12u1 Show 45 moreShow less1:10.11.19-0+deb12u11:10.11.3-11:10.11.3-2~exp11:10.11.4-11:10.11.4-1~deb12u11:10.11.5-11:10.11.5-21:10.11.5-31:10.11.6-0+deb12u11:10.11.6-11:10.11.6-21:10.11.6-2.1~exp11:10.11.7-11:10.11.7-21:10.11.7-31:10.11.7-41:10.11.8-11:10.11.9-0+deb12u11:11.4.2-11:11.4.2-21:11.4.2-31:11.4.2-41:11.4.3-11:11.4.4-11:11.4.4-21:11.4.4-31:11.4.5-11:11.4.5-2~exp11:11.8.1-11:11.8.1-21:11.8.1-31:11.8.1-41:11.8.1-51:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-3 | None known |
mariadbDebian:13 | All versions, plus listed versions 1:11.8.2-11:11.8.3-0+deb13u11:11.8.3-11:11.8.5-11:11.8.5-2 Show 18 moreShow less1:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-0+deb13u11:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-0+deb13u11:11.8.8-11:11.8.9+ds-11:11.8.9+ds-21:11.8.9+ds-31:11.8.9+ds-4 | None known |
mariadbDebian:14 | before 1:11.8.9+ds-1, plus listed versions 1:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-3 Show 11 moreShow less1:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-1 | 1:11.8.9+ds-1 |
mariadb10.11Red Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-backupRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-client-utilsRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-commonRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-connect-engineRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-cracklib-password-checkRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mariadb10.11-develRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-embeddedRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-embedded-develRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-errmsgRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-gssapi-serverRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-oqgraph-engineRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-pamRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-rocksdb-engineRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-s3-engineRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-serverRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-server-galeraRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-server-utilsRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-sphinx-engineRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb10.11-testRed Hat:hummingbird:1 | before 3:10.11.18-4.1.11.hum1 | 3:10.11.18-4.1.11.hum1 |
mariadb-10.0Ubuntu:16.04:LTS | All versions, plus listed versions 10.0.20-0ubuntu0.15.04.110.0.22-0ubuntu110.0.23-110.0.23-210.0.24-7 Show 9 moreShow less10.0.25-0ubuntu0.16.04.110.0.27-0ubuntu0.16.04.110.0.28-0ubuntu0.16.04.110.0.29-0ubuntu0.16.04.110.0.31-0ubuntu0.16.04.210.0.33-0ubuntu0.16.04.110.0.34-0ubuntu0.16.04.110.0.36-0ubuntu0.16.04.110.0.38-0ubuntu0.16.04.1 | None known |
mariadb-10.1Ubuntu:18.04:LTS | All versions, plus listed versions 10.1.25-11:10.1.29-61:10.1.34-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.2 Show 6 moreShow less1:10.1.40-0ubuntu0.18.04.11:10.1.41-0ubuntu0.18.04.11:10.1.43-0ubuntu0.18.04.11:10.1.44-0ubuntu0.18.04.11:10.1.47-0ubuntu0.18.04.11:10.1.48-0ubuntu0.18.04.1 | None known |
mariadb-10.3Ubuntu:20.04:LTS | All versions, plus listed versions 1:10.3.17-11:10.3.18-11:10.3.19-11:10.3.21-21:10.3.22-1 Show 10 moreShow less1:10.3.22-1ubuntu11:10.3.25-0ubuntu0.20.04.11:10.3.29-0ubuntu0.20.04.11:10.3.30-0ubuntu0.20.04.11:10.3.31-0ubuntu0.20.04.11:10.3.32-0ubuntu0.20.04.11:10.3.34-0ubuntu0.20.04.11:10.3.37-0ubuntu0.20.04.11:10.3.38-0ubuntu0.20.04.11:10.3.39-0ubuntu0.20.04.2 | None known |
mariadb-10.6Ubuntu:22.04:LTS | All versions, plus listed versions 1:10.6.7-2ubuntu11:10.6.7-2ubuntu1.11:10.6.11-0ubuntu0.22.04.11:10.6.12-0ubuntu0.22.04.11:10.6.16-0ubuntu0.22.04.1 Show 4 moreShow less1:10.6.18-0ubuntu0.22.04.11:10.6.21-0ubuntu0.22.04.21:10.6.22-0ubuntu0.22.04.11:10.6.23-0ubuntu0.22.04.1 | None known |
mariadbUbuntu:24.04:LTS | All versions, plus listed versions 1:10.11.4-11:10.11.5-31:10.11.6-11:10.11.6-21:10.11.7-2ubuntu1 Show 5 moreShow less1:10.11.7-2ubuntu21:10.11.8-0ubuntu0.24.04.11:10.11.11-0ubuntu0.24.04.21:10.11.13-0ubuntu0.24.04.11:10.11.14-0ubuntu0.24.04.1 | None known |
mariadbUbuntu:26.10 | All versions, plus listed versions 1:11.8.6-51:11.8.8-11:11.8.9+ds-4ubuntu2 | None known |
mariadbUbuntu:26.04:LTS | All versions, plus listed versions 1:11.8.3-1build11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-4 Show 5 moreShow less1:11.8.6-11:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-5ubuntu0.1 | None known |
mariadbopenSUSE:Tumbleweed From an advisory covering 22 CVEs | before 12.3.2-3.1 | 12.3.2-3.1 |
What each source reports
CVE List Score used
MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-05
EUVDEUVD-2026-117548
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
EUVD-2026-117548- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
NVD
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-07
OSVBELL-CVE-2026-102523
- Record
BELL-CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSV
MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-102523
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
DEBIAN-CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSVRHSA-2026:97938
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:97938- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-102523
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
UBUNTU-CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSVopenSUSE-SU-2026:12245-1No score
libmariadbd-devel-12.3.2-3.1 on GA media
These are all security issues fixed in the libmariadbd-devel-12.3.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12245-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | NVD, OSV | |
| affected | EUVD, NVD, OSV | |
| aliases, references | CVE List, NVD, OSV | |
| aliases, products | EUVD | |
| cwes, description, facts, products, references, severity, title | CVE List | |
| affected, aliases, references | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/MariaDB/server/security/advisories/GHSA-h4vr-wpff-jfx4
Show 36 moreShow less
jira.mariadb.org/browse/MDEV-40413
docs.bell-sw.com/security/cves/CVE-2026-102523
nvd.nist.gov/vuln/detail/CVE-2026-102523
security-tracker.debian.org/tracker/CVE-2026-102523
access.redhat.com/errata/RHSA-2026:97938
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_97938.json
bugzilla.redhat.com/show_bug.cgi?id=2567501
cve.org/CVERecord?id=CVE-2026-102523
ubuntu.com/security/CVE-2026-102523
suse.com/security/cve/CVE-2026-102523
Left out here: 8 versions. The JSON record has them.