# CVE-2026-86047: MariaDB SQL injection in SHOW CREATE and mariadb-dump

Source: https://junglewise.ai/threats/cve-2026-86047-mariadb-server-is-a-community-developed-fork-of-mysql-server-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-86047 · Severity: high · CVSS 7.7 · Published 2026-10-16

MariaDB is a database server used to store and retrieve data for applications and websites. When administrators use SHOW CREATE SERVER, SHOW CREATE USER commands or export databases with mariadb-dump, the software fails to properly escape special characters in identifiers and values. An attacker with low database privileges can craft malicious usernames or object names that inject extra SQL commands, which then execute when a database administrator applies the exported data to another server.

Technologies: [MariaDB Server](https://junglewise.ai/threats/technologies/mariadb-mariadb-server). Vendors: [Mariadb](https://junglewise.ai/threats/vendors/mariadb).

## Quick answers

**Is CVE-2026-86047 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86047 being exploited in the wild.

**How severe is CVE-2026-86047?** High severity, with a CVSS score of 7.7, published 16 October 2026.

**Which products and versions are affected?** MariaDB Server 10.6.1 to 10.6.27, 10.11.x to 10.11.18, 11.4.x to 11.4.12, 11.8.x to 11.8.8, 12.3.x to 12.3.2, 13.0.x to 13.0.1.

**Is there a fix for CVE-2026-86047?** Yes: fixed in MariaDB Server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86047 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-86047?** Check whether you run MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in MariaDB Server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2

## Technical details

This SQL injection vulnerability exists in SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump due to inconsistent quoting of identifiers and string values during SQL serialization. A low-privileged attacker can create database objects with crafted identifiers or values containing SQL syntax that, when included in the output of these commands, results in unescaped injected SQL statements. An administrator applying the dump or recreating the object from SHOW output will unknowingly execute the attacker's injected SQL with their elevated privileges.

## Affected products

- MariaDB MariaDB Server 10.6.1 to 10.6.27, 10.11.x to 10.11.18, 11.4.x to 11.4.12, 11.8.x to 11.8.8, 12.3.x to 12.3.2, 13.0.x to 13.0.1

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52](https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52)
- [https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5](https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5)

## Related threats

- [MariaDB ALTER TABLE filename encoding bypass in CONVERT PARTITION](https://junglewise.ai/threats/cve-2026-102523-mariadb-server-is-a-community-developed-fork-of-mysql-server)
- [MariaDB GRANT PROXY authorization bypass with empty password](https://junglewise.ai/threats/cve-2026-97380-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB server table name encoding bypass via #mysql50# prefix](https://junglewise.ai/threats/cve-2026-92262-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB CONNECT engine file access bypass in JSON UDFs](https://junglewise.ai/threats/cve-2026-85985-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)
- [MariaDB use-after-free in SYS_REFCURSOR cursor handling](https://junglewise.ai/threats/cve-2026-85748-mariadb-server-is-a-community-developed-fork-of-mysql-server-from)