Key points
- MariaDB versions through 10.6.27, 10.11.18, 11.4.12, and 11.8.8 are vulnerable.
- The flaw allows low-privileged users to reset other accounts' passwords.
- Fixes are available in the latest minor releases of all affected series.
MariaDB server versions from 10.6.1 up to 10.6.27, 10.11.1 up to 10.11.18, 11.4.1 up to 11.4.12, and 11.8.1 up to 11.8.8 contain a high-severity authorization error. The National Vulnerability Database rates CVE-2026-97380 with a CVSS score of 8.8. This flaw exists in the community-developed fork of MySQL server. Administrators must update to the latest minor versions to resolve the issue.
In plain English
The problem involves how MariaDB handles the GRANT PROXY statement. When an administrator tries to grant proxy privileges using an IDENTIFIED clause with an empty password, the server incorrectly treats this as if no authentication was specified. This causes the system to check the wrong grantor privileges. A low-privileged attacker who knows another account name can exploit this error. The attacker can then set that account's password, effectively taking control of it.
The background
MariaDB is a popular open-source relational database management system. It is a community-developed fork of MySQL server. The vulnerability is classified under CWE-620 and CWE-863 in the Common Weakness Enumeration. The issue affects multiple major version branches of the software. The flaw allows for unauthorized privilege escalation through a specific misuse of the proxy grant feature.
What changes now
The vendor has released patches for all affected version lines. Users on 10.6 must upgrade to 10.6.28. Those on 10.11 should move to 10.11.19. Version 11.4 users need 11.4.13, while 11.8 users require 11.8.9. Additionally, versions 12.3.3 and 13.0.2 contain the fixes. These updates correct the authorization logic in the GRANT PROXY statement. Applying these updates eliminates the risk of password resets via this method.
Who needs to act first
Teams usually prioritize systems exposed to the internet or internal networks with many users. Check whether any servers run the vulnerable versions listed above. Before applying updates, back up your databases and configurations to prevent data loss. Test the patch in a non-production environment first to ensure compatibility with your applications. Roll out the fix to critical systems first, then to less critical ones. Monitor logs for any unusual grant attempts during the transition.
What to do and how to stay safe: MariaDB
- Verify which MariaDB versions are running on your servers and compare them against the vulnerable list.
- Schedule immediate updates to the patched versions for any exposed or critical database instances.
- Review database logs for any recent GRANT PROXY statements that might indicate exploitation.
- Restrict network access to database ports to only trusted application servers until patches are applied.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which MariaDB versions are affected by CVE-2026-97380?
Versions 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, and 11.8.1 through 11.8.8 are affected.
What is the severity of this vulnerability?
The National Vulnerability Database rates CVE-2026-97380 as HIGH with a CVSS score of 8.8.
Is there a fix available for this issue?
Yes, fixes are available in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
