CVE-2026-97380: MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 10.6.28 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 10.11.19 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 11.4.13 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 11.8.9 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
MariaDB serverto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
Which MariaDB Server releases need to be remediated?
The issue affects releases from 10.6.1 up to, but not including, 10.6.28 in the 10.6 series. Fixed releases are 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
What access does an attacker need?
An attacker needs a low-privileged MariaDB account and must be able to name the account they want to target. No user interaction is required.
What can successful exploitation allow?
The authorization error can allow the attacker to set another account's password through a GRANT PROXY statement containing an IDENTIFIED clause with an empty password. This may enable compromise of the targeted account.