CVE-2026-107823: How a Crafted Username Becomes MariaDB Security Metadata

Vulnerability overview

CVE-2026-107823 is the lowest-scored flaw in the October 2026 MariaDB Server set at 7.2 under CVSS v3.1, and it is the one most likely to be misread as a rounding error beside the higher numbers in the same release. The flaw is a privilege escalation inside the database itself, disclosed in CSA Singapore alert AL-2026-144 together with CVE-2026-107814, CVE-2026-107815, CVE-2026-107818 and CVE-2026-107821.

Mechanism and exploitation conditions

The advisory describes the mechanism precisely. An authenticated user who holds both CREATE USER and CREATE VIEW WITH GRANT OPTION can create a crafted username containing additional view metadata. The parser then interprets part of that username as security metadata, which can allow the attacker to escalate database privileges.

This is metadata smuggling across a boundary the parser assumed was safe. Usernames are usually treated as identity labels, not as containers that can carry structured content into a privileged parsing path. When the same string is read twice with different grammar, the second read can accept what the first read merely stored.

The prerequisites are the story here. An attacker needs a working authenticated session, CREATE USER and CREATE VIEW WITH GRANT OPTION. A least-privilege deployment grants none of these to application accounts. A development or reporting account that was given CREATE USER for convenience hands over the first half of the chain, and WITH GRANT OPTION in view creation adds the second.

Impact

Successful exploitation elevates database privileges. In practice that means the attacker moves from an account with limited scope to one that can read or modify objects it was never intended to touch, and potentially to administrative capability over the instance.

The blast radius extends past the compromised schema. A database account with elevated privileges can enumerate other tenants on a shared instance, inspect stored procedures, and reach linked servers. Credential material stored in tables becomes readable, which is often the shortest path to systems outside the database.

Affected products and scope

Affected versions are 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1. The advisory does not name a public proof of concept and does not report active exploitation, so prioritisation should rest on privilege grants rather than on threat-actor signals.

Exposure context

A ZoomEye query for vul.cve="CVE-2026-107823" returned no indexed assets at the time of writing, which is unsurprising for a privilege-escalation flaw that does not announce itself in a banner. A broader fingerprint query, app="MariaDB", returns 5111720 assets. Neither number identifies vulnerable hosts, and a zero CVE count is not evidence that no instance is affected.

ZoomEye search: https://www.zoomeye.ai/searchResult?q=YXBwPSJNYXJpYURCIg%3D%3D

Remediation and mitigations

Apply the vendor update for your branch and confirm the build string afterwards. Then treat the grant surface as the real control.

Inventory accounts with CREATE USER, and treat CREATE VIEW WITH GRANT OPTION as an administrative capability rather than a reporting default. Remove GRANT OPTION from view-definition accounts unless delegation is genuinely required. Separate application identities from schema-management identities so that a compromised application cannot craft usernames in the first place.

Detection is awkward because the exploit resembles normal DDL activity. Alert on creation of usernames containing unusual delimiters or long structured suffixes, and on view creation by accounts that normally only read. Review grants quarterly as a standing control, not as a one-off response to this advisory.

References

• CSA Singapore alert AL-2026-144: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-144/
• NVD entry for CVE-2026-107823: https://nvd.nist.gov/vuln/detail/cve-2026-107823