CVE-2026-92796: Manticore Search Auth Bypass Vulnerability

CVE-2026-92796 Overview

CVE-2026-92796 is an authorization bypass vulnerability in Manticore Search versions 27.0.0 through 28.4.3. The database engine fails to validate permissions across all statements in multi-statement SQL requests. Read-only users can append additional SELECT statements after an authorized first statement to access restricted data. Attackers exploit this flaw to read internal credential tables and extract administrator password hashes. Because Manticore's MySQL authentication protocol accepts these hashes directly, adversaries authenticate as administrators without recovering plaintext passwords. The vulnerability is tracked under CWE-863: Incorrect Authorization and is fixed in version 28.4.4.

Critical Impact

Authenticated read-only users can escalate to full administrative control of Manticore Search instances by stealing password hashes usable as authentication credentials.

Affected Products

• Manticore Search 27.0.0 through 28.4.3
• Deployments exposing the MySQL protocol interface (auth_proto_mysql)
• Multi-tenant Manticore Search environments with role-based access controls

Discovery Timeline

• 2026-09-16 - CVE-2026-92796 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92796

Vulnerability Analysis

Manticore Search supports multi-statement SQL requests, where clients submit multiple semicolon-separated statements in a single query. The permission check runs only against the first statement in the request. Subsequent statements execute with the same session context but bypass authorization enforcement entirely.

A read-only user issues a benign SELECT on a permitted index, then appends a query against internal system tables containing account records. The engine processes the second statement without verifying that the caller has rights to read credential material. The response returns password hashes for privileged accounts.

Manticore's MySQL authentication handler compares stored hashes against client-supplied credentials without requiring the original plaintext. See the authentication logic in the Manticore auth code segment. An attacker replays the extracted hash directly to authenticate as an administrator, converting a limited read primitive into full instance takeover.

Root Cause

The root cause is missing per-statement authorization within the multi-statement request handler. Access control is treated as a request-level check rather than a statement-level check, violating the principle of complete mediation described in CWE-863.

Attack Vector

Exploitation requires network access to the Manticore MySQL protocol port and valid low-privilege credentials. The attacker submits a crafted multi-statement query, parses hash values from the response, and reconnects using those hashes as administrator. Full technical detail is available in the VulnCheck advisory and the Manticore Search research writeup.

Detection Methods for CVE-2026-92796

Indicators of Compromise

• Query logs containing multi-statement requests from low-privilege accounts that reference system or authentication tables.
• Authentication events where an administrator account logs in from an IP address previously associated with a read-only user session.
• Unusual SELECT activity targeting internal credential storage shortly before administrative logins.

Detection Strategies

• Enable Manticore query logging and alert on semicolon-delimited multi-statement requests that read user or credential tables.
• Correlate source IPs across sessions to identify role escalation between the same client and different privilege levels.
• Baseline expected query patterns per role and flag deviations, particularly access to metadata not required by application workloads.

Monitoring Recommendations

• Forward Manticore Search logs to a centralized analytics platform for retention and correlation with authentication events.
• Monitor MySQL protocol traffic to Manticore instances for anomalous query composition and volume from application service accounts.
• Track administrator authentication attempts and alert on new source addresses or off-hours logins.

How to Mitigate CVE-2026-92796

Immediate Actions Required

• Upgrade Manticore Search to version 28.4.4 or later, which enforces authorization on every statement in multi-statement requests.
• Rotate all Manticore user credentials, including administrator accounts, because existing hashes may have been exfiltrated.
• Audit query logs from the exposure window for signs of credential table access by non-privileged users.
• Restrict network exposure of the Manticore MySQL protocol port to trusted application hosts only.

Patch Information

The fix is included in Manticore Search release 28.4.4. See the Manticore Search repository and the corresponding issue #4706 for details on the corrected authorization logic in auth_proto_mysql.cpp.

Workarounds

• Disable multi-statement query support in client drivers connecting to Manticore where the feature is not required.
• Enforce network segmentation and firewall rules so only application backends can reach the Manticore listener.
• Apply least-privilege principles by removing read access to credential and system tables from application accounts wherever supported.

# Verify installed Manticore Search version and upgrade to a fixed release
searchd --version

# Debian/Ubuntu upgrade path
sudo apt-get update
sudo apt-get install --only-upgrade manticore=28.4.4-*

# Restart the service after upgrade
sudo systemctl restart manticore