---
cve: "CVE-2026-86047"
severity: "HIGH"
cvss: 7.7
epss: "0.5%"
vendor: "MariaDB"
kev: false
exploited: false
published: "2026-10-16 16:37:04"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-29T14:37:30+01:00"
---

# CVE-2026-86047

> 7.7 HIGH · 🧪 PoC

## Beschreibung

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-10-19 12:42:14
- CNA-CVSS: **7.7** (`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Gering | warn |
| UI Interaktion | Erforderlich | good |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Keine | good |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-89** — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as…

## Angriffsmuster (CAPEC)

- [CAPEC-7 — Blind SQL Injection](https://capec.mitre.org/data/definitions/7.html) _(Severity: High)_
- [CAPEC-66 — SQL Injection](https://capec.mitre.org/data/definitions/66.html) _(Severity: High)_
- [CAPEC-108 — Command Line Execution through SQL Injection](https://capec.mitre.org/data/definitions/108.html) _(Severity: Very High)_
- [CAPEC-109 — Object Relational Mapping Injection](https://capec.mitre.org/data/definitions/109.html) _(Severity: High)_
- [CAPEC-110 — SQL Injection through SOAP Parameter Tampering](https://capec.mitre.org/data/definitions/110.html) _(Severity: Very High)_
- [CAPEC-470 — Expanding Control over the Operating System from the Database](https://capec.mitre.org/data/definitions/470.html) _(Severity: Very High)_

## Patch verfügbar (OSV)

- 210ab6edf47fa73f3b77e974ed2e9357ccdd051c (Commit)
- 93e051860a9c7e87ee8cee6ed38b640d491f7170 (Commit)

## BSI-Hinweise (deutsch)

- [MariaDB: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-4018) — _BSI-Einstufung: hoch_
  Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MariaDB ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

## Referenzen

- <https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p>
- <https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52>
- <https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5>
- <https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a>
- <https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513>
- <https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b>
- <https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19>
- <https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28>
- <https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13>
- <https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9>
- <https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3>
- <https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2>
- <https://jira.mariadb.org/browse/MDEV-39776>
- <https://jira.mariadb.org/browse/MDEV-39818>
- <https://jira.mariadb.org/browse/MDEV-40308>
- <https://jira.mariadb.org/browse/MDEV-40311>
- <https://jira.mariadb.org/browse/MDEV-40312>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-86047/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_