CVE-2026-107822

Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.27 MariaDB server version 10.11.18 and earlier MariaDB server version 11.4.12 and earlier MariaDB server version 11.8.8 and earlier MariaDB server version 12.3.2 and earlier MariaDB server version 13.0.1 and earlier

Description The ACL cache can generate identical database-privilege cache keys for roles and localhost user names that match due to the use of an empty IP component. An attacker with CREATE USER permissions can create a colliding principal to exercise privileges assigned to another account once the original principal's database privileges are cached.

Recommendations Update to version 10.6.28 Update to version 10.11.19 Update to version 11.4.13 Update to version 11.8.9 Update to version 12.3.3 Update to version 13.0.2