CVE-2026-107823: MariaDB Privilege Escalation Vulnerability

CVE-2026-107823 Overview

CVE-2026-107823 is a privilege escalation vulnerability in MariaDB server affecting the view FRM (form) file parser. The parser fails to safely encode embedded newline characters in usernames, allowing an authenticated attacker with CREATE USER and CREATE VIEW WITH GRANT OPTION privileges to craft a username containing additional view metadata. The parser then interprets portions of the username as security metadata, enabling escalation of database privileges. The flaw is tracked as [CWE-116] (Improper Encoding or Escaping of Output) and affects MariaDB versions from 10.6.1 through the fixed releases. MariaDB has patched the issue in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Critical Impact
Authenticated attackers with view and user creation privileges can escalate to higher database privileges by injecting newline-encoded security metadata into usernames.

Affected Products

MariaDB server 10.6.1 through 10.6.27
MariaDB server 10.11.x prior to 10.11.19, 11.4.x prior to 11.4.13, 11.8.x prior to 11.8.9
MariaDB server 12.3.x prior to 12.3.3 and 13.0.x prior to 13.0.2

Discovery Timeline

2026-10-09 - CVE-2026-107823 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107823

Vulnerability Analysis

MariaDB stores view definitions in FRM files that contain structured metadata, including the definer_user and definer_host fields used to determine the security context under which a view executes. The FRM parser reads these fields as line-terminated strings. When the parser encounters a username containing a raw newline character, it treats the content following the newline as a new metadata directive. An attacker who holds CREATE USER and CREATE VIEW WITH GRANT OPTION can create an account whose name embeds crafted directives such as a modified suid flag or alternate definer_user entry. When MariaDB later reads the resulting view FRM file, it parses the injected metadata and assigns a stronger security context than intended, enabling privilege escalation across database objects.

Root Cause

The root cause is improper output encoding during FRM serialization. The definer_user and definer_host fields were serialized using the FILE_OPTIONS_STRING type, which writes string values without escaping line terminators. Because the FRM format itself is line-oriented, any newline inside a stored value terminates the field early and allows subsequent bytes to be re-interpreted as new structured options.

Attack Vector

Exploitation requires a network-accessible MariaDB instance and an authenticated session with high privileges (CREATE USER plus CREATE VIEW WITH GRANT OPTION). The attacker creates a crafted user, defines a view with that user as definer, and relies on normal view loading to trigger the metadata reinterpretation. No user interaction is required.

The upstream patch converts both definer_user and definer_host from the unescaped FILE_OPTIONS_STRING type to the escaped FILE_OPTIONS_ESTRING type, ensuring embedded newline bytes are encoded on write and decoded on read.

   FILE_OPTIONS_VIEW_ALGO},
  {{ STRING_WITH_LEN("definer_user")},
   my_offsetof(TABLE_LIST, definer.user),
-  FILE_OPTIONS_STRING},
+  FILE_OPTIONS_ESTRING},
  {{ STRING_WITH_LEN("definer_host")},
   my_offsetof(TABLE_LIST, definer.host),
-  FILE_OPTIONS_STRING},
+  FILE_OPTIONS_ESTRING},
  {{ STRING_WITH_LEN("suid")},
   my_offsetof(TABLE_LIST, view_suid),
   FILE_OPTIONS_ULONGLONG},

Source: MariaDB commit 8a642bc8

Detection Methods for CVE-2026-107823

Indicators of Compromise

Usernames in mysql.user or mysql.global_priv that contain non-printable characters, specifically 0x0A (newline) or 0x0D (carriage return).
View FRM files under the data directory whose definer_user or definer_host lines contain unexpected keywords such as suid, algorithm, or with_check_option.
Unexpected changes to the effective definer of existing views after new account creation events.

Detection Strategies

Audit CREATE USER statements for account names containing escape sequences or multi-line values using MariaDB general query log or audit plugin output.
Compare the parsed DEFINER returned by SHOW CREATE VIEW against the raw bytes in the corresponding .frm file to find mismatches introduced by metadata injection.
Query information_schema.VIEWS and flag any row whose DEFINER column contains characters outside the standard identifier set.

Monitoring Recommendations

Forward MariaDB audit plugin events to a central log pipeline and alert on CREATE USER or GRANT statements followed closely by CREATE VIEW from the same session.
Monitor privilege changes on sensitive schemas and correlate with recent account creation events.
Track MariaDB version strings across the fleet to confirm patched builds are deployed.

How to Mitigate CVE-2026-107823

Immediate Actions Required

Upgrade MariaDB to a fixed release: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2.
Review all accounts holding CREATE USER together with CREATE VIEW WITH GRANT OPTION and reduce the set to the minimum required.
Enumerate existing accounts for usernames containing newline or carriage-return bytes and remove or rename them.

Patch Information

The fix is published in the MariaDB security advisory GHSA-g2q2-3936-cp37 and tracked as MDEV-40484. Fixed binaries are available in the 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 release tags.

Workarounds

Revoke CREATE USER and GRANT OPTION from any role or account that does not strictly require them until the patch is deployed.
Implement a pre-flight check that rejects CREATE USER and RENAME USER statements whose target name contains control characters.
Restrict network exposure of the MariaDB port to trusted application tiers using host firewall rules.

bash

# Example: identify accounts with suspicious characters in usernames
mariadb -e "SELECT User, Host, HEX(User) FROM mysql.user \
  WHERE User REGEXP '[[:cntrl:]]';"

# Verify patched version post-upgrade
mariadb -e "SELECT VERSION();"