MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

Summary

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Timeline

1. Oct 16, 2026, 4:23 PM UTCCVE published
2. Oct 28, 2026, 6:06 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 28, 2026, 6:07 PM UTCRecord last updated

Affected versions

• MariaDB server

  From 10.6.1 · fixed in 10.6.28; From 10.11.1 · fixed in 10.11.19; From 11.4.1 · fixed in 11.4.13; From 11.8.1 · fixed in 11.8.9; From 12.3.1 · fixed in 12.3.3; From 13.0.1 · fixed in 13.0.2

• mariadbBitnami

  From 10.6.1 · fixed in 10.6.28; From 10.11.0 · fixed in 10.11.19; From 11.4.0 · fixed in 11.4.13; From 11.8.0 · fixed in 11.8.9; From 12.3.0 · fixed in 12.3.3; From 13.0.0 · fixed in 13.0.2

• mariadb-minBitnami

  From 10.6.1 · fixed in 10.6.28; From 10.11.0 · fixed in 10.11.19; From 11.4.0 · fixed in 11.4.13; From 11.8.0 · fixed in 11.8.9; From 12.3.0 · fixed in 12.3.3; From 13.0.0 · fixed in 13.0.2

• mysql-clientBitnami

  From 10.6.1 · fixed in 10.6.28; From 10.11.0 · fixed in 10.11.19; From 11.4.0 · fixed in 11.4.13; From 11.8.0 · fixed in 11.8.9; From 12.3.0 · fixed in 12.3.3; From 13.0.0 · fixed in 13.0.2

References 9