Three 9.9s and a Dump That Plants Its Own SQL: MariaDB’s Seven-CVE October Batch

2026-10-21 Agent & Supply Chain Security by al-ice.ai Editorial

On 16 October 2026, MariaDB disclosed seven vulnerabilities at once — three of them rated CVSS 9.9, two high, two medium — with fixes in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. No exploitation in the wild and no public PoC have been confirmed, which is roughly where the good news ends. The batch is a concentration of the exact properties that make database flaws expensive: several are reachable by low-privileged authenticated users, one turns your own backup pipeline into a code-execution vector, and one is a memory-disclosure bug whose stated purpose in the advisory is to defeat ASLR as part of a chained exploit. For anyone whose agent infrastructure, model registries, evaluation harnesses or internal tooling sit on MariaDB — which, in self-hosted stacks, is a great deal of it — this is a patch-now batch wearing a patch-soon disguise.

The three 9.9s: a filename shortcut, a GIS overflow, a dangling cursor

CVE-2026-92262 is the most evocative of the three. MariaDB retains a legacy #mysql50# table-name prefix for pre-5.1 compatibility, and names carrying it skip the normal filename encoding — letting an attacker reach files directly, with data corruption, data exfiltration or remote code execution as the outcome depending on what the reachable paths allow. Compatibility shims that bypass a security transformation are a recurring species — this site covered the same shape in session-escape flaws in embedded database tooling — and they share a depressing property: the vulnerable behaviour exists precisely for databases old enough that nobody remembers configuring it.

CVE-2026-85746 is a memory-write overflow in ST_AsText when converting deeply nested GIS objects, and CVE-2026-85748 is a use-after-free in SYS_REFCURSOR handling, found only in the 12.3 and 13.0 branches. MariaDB’s own characterisation is unusually candid about exploitability: for the latter two, code execution needs a second bug. Which brings us to CVE-2026-85745 (CVSS 4.3), a memory leak the reporting describes as useful for bypassing ASLR as part of a multi-vulnerability chain. Read those three advisories together and the vendor is handing you a recipe: info-leak plus memory-corruption, co-disclosed, in the same release. The individual scores understate the composed risk, and anyone triaging 85746/85748 as “needs a second bug, we’ll get to it” should understand the second bug shipped in the same announcement.

The rest of the batch: password-setting proxies and self-planting dumps

CVE-2026-97380 (CVSS 8.8) is the one access-control teams should read first: a GRANT PROXY flaw that lets a low-privileged user set another account’s password. In hosting and multi-tenant setups — and in the plugin-and-customer-database-accounts pattern the reporting calls out — that primitive converts directly into privilege escalation: pick the account whose privileges you want, set its password, log in as it. There is no memory-corruption uncertainty to hide behind; it is a logic flaw in authorisation, the kind that works the first time.

CVE-2026-86047 (CVSS 7.7) is the batch’s slowest-burning fuse: poor quoting in SHOW CREATE output and in mariadb-dump can plant SQL that executes when a dump is restored. Your backup is the delivery mechanism and your disaster-recovery run is the trigger — the malicious statements sit inert in an artifact everyone treats as trusted data until the worst possible moment. Review recent dumps before restoring them, and treat dump files from untrusted tenants as untrusted input, not as snapshots.

CVE-2026-85985 (5.4) has the CONNECT engine’s file functions skipping the FILE privilege check, and the advisories note that none of the seven appear in CISA’s KEV catalog with exploitation marked “none” for the three assessed so far. Absence from KEV is a statement about observed exploitation, not about exploitability — and with a dump-restore vector plus a proxy-password vector, both reachable without exotic preconditions, this batch does not need memory-corruption reliability to be weaponised.

We confirmed the remediation side first-hand: all six fixed-release tags — mariadb-10.6.28, mariadb-10.11.19, mariadb-11.4.13, mariadb-11.8.9, mariadb-12.3.3 and mariadb-13.0.2 — resolve in MariaDB’s public MariaDB/server repository, so the upgrade targets are real and available, not merely announced.

What to do

Upgrade to the fixed release for your branch now: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 or 13.0.2. Prioritise internet-adjacent instances and any instance where untrusted users or plugins hold database accounts — the low-privilege reachability of the 9.9s and the 8.8 makes this batch worse than its “authenticated attacker” label sounds.
Audit GRANT PROXY grants and recent password changes for CVE-2026-97380 exposure: look for proxy grants held by low-privilege accounts and any password change on a privileged account you cannot explain. Rotate credentials on accounts that could have been proxy-targeted.
Quarantine-and-review dump files before the next restore. Inspect recent mariadb-dump output for unexpected statements (CVE-2026-86047), especially dumps sourced from tenant or plugin-controlled databases, and regenerate dumps after patching rather than restoring pre-patch artifacts into fixed servers.
Disable the CONNECT engine if you do not use it (CVE-2026-85985), and limit database accounts for untrusted users and plugins to least privilege across the board — the batch rewards every unnecessary grant.
Track the composed risk, not just the scores. The ASLR-bypassing leak in CVE-2026-85745 exists to make CVE-2026-85746 and CVE-2026-85748 reliable; assess and patch the three as a unit, and watch for PoC publication — the step that historically converts “none confirmed” into KEV entries within days.

Our verification was read-only. The 16 October 2026 disclosure date, the count of seven CVEs, the three CVSS 9.9 ratings, the per-CVE descriptions (CVE-2026-92262 #mysql50# prefix, CVE-2026-85746 ST_AsText overflow, CVE-2026-85748 SYS_REFCURSOR use-after-free limited to 12.3/13.0, CVE-2026-97380 GRANT PROXY at 8.8, CVE-2026-86047 dump quoting at 7.7, CVE-2026-85985 CONNECT FILE-privilege skip at 5.4, CVE-2026-85745 ASLR-relevant leak at 4.3), the “needs a second bug” characterisation, the no-exploitation/no-PoC status and the six fixed release numbers were read from SecurityOnline’s 21 October 2026 report (Do Son) and are attributed to it throughout. The existence of all six fixed release tags was confirmed first-hand via ls-remote against the public MariaDB/server GitHub repository. No database was connected to and no exploit detail is reproduced. Brave Search was used for discovery only.

Sources: