MariaDB Fixes Critical Flaw Allowing Table Name Bypass and Remote Code Execution

MariaDB has released updates to address a critical security vulnerability in its server software that permits remote code execution. The National Vulnerability Database records the flaw as CVE-2026-92262, assigning it a maximum CVSS score of 9.9. This high-severity issue stems from how the database handles specific table-name prefixes, allowing attackers to bypass normal security controls.

The vulnerability arises because the `#mysql50#` prefix bypasses standard table-name filesystem encoding mechanisms. According to the NVD record, an attacker can trigger this issue by creating a table with the `#mysql50#` prefix. This action enables the use of legacy unencoded table names to access underlying files. Such access can lead to system crashes, data corruption, exfiltration of sensitive information, or full remote code execution on the affected server.

Context and Technical Background

MariaDB Server is a community-developed fork of the MySQL database server. The security flaw is classified under CWE-706, which relates to incorrect behavior within the system. The NVD description specifies that the `#mysql50#` prefix allows the system to circumvent normal table-name filesystem encoding. This bypass creates a pathway for unauthorized file access.

The National Vulnerability Database states that the issue is fixed in specific recent versions of the software. The patched versions include 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Users running any MariaDB Server version prior to these specific releases are considered vulnerable. The fix addresses the improper handling of the legacy prefix that led to the encoding bypass.

Who Is Affected

The vulnerability impacts a wide range of MariaDB Server versions. Affected versions include those from 10.6.1 up to, but not including, 10.6.28. It also affects versions from 10.11.1 up to, but not including, 10.11.19. Additionally, the flaw exists in versions from 11.4.1 up to, but not including, 11.4.13.

Further affected branches include versions from 11.8.1 up to, but not including, 11.8.9. The NVD record does not list a lower bound for versions 12.3 and 13.0, implying all versions prior to the fixed releases 12.3.3 and 13.0.2 are vulnerable. Organizations relying on these older database iterations need to verify their current version immediately.

What should you do?

Administrators should check their current MariaDB Server version against the list of affected releases. If the installed version is older than the fixed versions listed in the NVD record, an upgrade is necessary. Users should apply the updates to versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 depending on their major release branch.