{"id":"CVE-2026-107822","summary":"MariaDB: database privilege escalation via user / role name collision in the acl cache","details":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","aliases":["BIT-mariadb-2026-107822","BIT-mariadb-min-2026-107822","BIT-mysql-client-2026-107822","GHSA-2m85-2x26-36rf"],"modified":"2026-10-22T16:30:44.790064438Z","published":"2026-10-09T17:28:47.578Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-706","CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107822.json"},"references":[{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"},{"type":"WEB","url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"},{"type":"WEB","url":"https://jira.mariadb.org/browse/MDEV-40541"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107822.json"},{"type":"ADVISORY","url":"https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822"},{"type":"FIX","url":"https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mariadb/server","events":[{"introduced":"00a8357bd30fdfca23720448a3f638290b6d35b7"},{"fixed":"210ab6edf47fa73f3b77e974ed2e9357ccdd051c"},{"introduced":"2437674291f31c91869a74eb6ebd9f03dc52bd43"},{"fixed":"93e051860a9c7e87ee8cee6ed38b640d491f7170"},{"introduced":"fa69b085b10f19a3a8b6e7adab27c104924333ae"},{"fixed":"170b1d70737be6f134448f51713cdc1ae215b420"},{"introduced":"1c4aed7c680c0402d6e97e097f03815c0e9bf4c5"},{"fixed":"bf9193a939f515e95dd8def1a5468088c91cede6"},{"introduced":"21a0714a118614982d20bfa504763d7247800091"},{"fixed":"83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"},{"introduced":"7f923870722c5d382e16d56af526d1ee4e03f987"},{"fixed":"620a4b5624222048fece7fe1789978ae0675cae2"},{"fixed":"67ea07dd3400004e4f7ae01bf977f4344bbe064b"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"10.6.1"},{"fixed":"10.6.28"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*","range":[{"introduced":"10.11.1"},{"fixed":"10.11.19"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*","range":[{"introduced":"11.4.1"},{"fixed":"11.4.13"}]},{"range":[{"introduced":"11.8.1"},{"fixed":"11.8.9"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"12.3.1"},{"fixed":"12.3.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*","range":[{"introduced":"13.0.1"},{"fixed":"13.0.2"}],"source":"CPE_RANGE"},{"range":[{"fixed":"67ea07dd3400004e4f7ae01bf977f4344bbe064b"}],"source":"REFERENCES_COMMIT"},{"original_tag":"mariadb-10.11.19","range":[{"fixed":"93e051860a9c7e87ee8cee6ed38b640d491f7170"}],"source":"REFERENCES_TAG"},{"source":"REFERENCES_TAG","original_tag":"mariadb-10.6.28","range":[{"fixed":"210ab6edf47fa73f3b77e974ed2e9357ccdd051c"}]},{"source":"REFERENCES_TAG","original_tag":"mariadb-11.4.13","range":[{"fixed":"170b1d70737be6f134448f51713cdc1ae215b420"}]},{"original_tag":"mariadb-11.8.9","range":[{"fixed":"bf9193a939f515e95dd8def1a5468088c91cede6"}],"source":"REFERENCES_TAG"},{"original_tag":"mariadb-12.3.3","range":[{"fixed":"83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"}],"source":"REFERENCES_TAG"},{"range":[{"fixed":"620a4b5624222048fece7fe1789978ae0675cae2"}],"source":"REFERENCES_TAG","original_tag":"mariadb-13.0.2"}]}}],"versions":["mariadb-13.0.1","mariadb-10.6.27","mariadb-11.8.7b","mariadb-11.4.11b","mariadb-10.6.26","mariadb-11.8.7","mariadb-11.4.11","mariadb-12.3.1","mariadb-11.8.6","mariadb-11.4.10","mariadb-10.6.25","mariadb-11.8.4","mariadb-11.4.9","mariadb-10.6.24","mariadb-11.8.3","mariadb-10.6.23","mariadb-11.4.8","mariadb-11.8.2","mariadb-10.6.20","mariadb-11.4.7","mariadb-10.6.5","mariadb-11.4.6","mariadb-10.6.22","mariadb-11.8.1","mariadb-11.4.5","mariadb-10.6.21","mariadb-11.4.4","mariadb-10.6.18","mariadb-11.4.3","mariadb-10.6.19","mariadb-10.6.17","mariadb-11.4.2","mariadb-11.4.1","mariadb-10.6.16","mariadb-10.6.12","mariadb-10.6.14","mariadb-10.6.13","mariadb-10.6.11","mariadb-10.6.8","mariadb-10.6.9","mariadb-10.6.10","mariadb-10.6.6","mariadb-10.6.4","mariadb-10.6.3","mariadb-10.6.2","mariadb-10.6.1"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e","target":{"file":"sql/log_event_server.cc","function":"Rows_log_event_fragmenter::fragment"},"deprecated":false,"digest":{"function_hash":"339712868486696881928202886484344029960","length":1715},"id":"CVE-2026-107822-1cd3e8db","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["265577632303887446289749120585557906012","90338461107598051749602183626527029076","135974257990159682542061181314070611477","59440921527566409168742990730026725636","871135494022066138858656571240698570","247293449498909397416026347351022219912","179396894775406735805665784479451940140","269443033021460921618747189093528286356","259691733175197008076763079871985256069","102338916828131457031608538914692707050","65381815336936246662830619643818353906","7100122396357284882133944108516856108","161393146120866756988306743699529625075"]},"id":"CVE-2026-107822-6d62851c","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6","target":{"file":"sql/item_vectorfunc.cc"}},{"source":"https://github.com/mariadb/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","target":{"file":"sql/sql_acl.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["294187237149416057080918645267222402135","283055354525272166759678965421068218151","134811447781922216158747182151740728947","175341161064196556624033445047087766879"]},"id":"CVE-2026-107822-be6884b1","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6","target":{"file":"sql/item_vectorfunc.cc","function":"Item_func_vec_fromtext::fix_length_and_dec"},"deprecated":false,"digest":{"function_hash":"73617688475456381632237133958511949829","length":361},"id":"CVE-2026-107822-c0933a1f"},{"id":"CVE-2026-107822-cffe9670","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","target":{"function":"acl_get","file":"sql/sql_acl.cc"},"deprecated":false,"digest":{"length":1856,"function_hash":"218189371449465772794356865534982211923"}},{"id":"CVE-2026-107822-e432b228","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e","target":{"file":"sql/log_event_server.cc"},"deprecated":false,"digest":{"line_hashes":["171922335289695664967320282302097012127","314879264303882873216162120692739820747","296657960952465744719770094395708912555","28908880241426286725700820784852115102"],"threshold":0.9}}],"vanir_signatures_modified":"2026-10-22T16:30:44Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-107822.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"}]}