Key points
- CVE-2026-92262 is rated Critical with a CVSS score of 9.9.
- The flaw affects MariaDB versions from 10.6.1 through 10.6.27 and other specific older releases.
- Patches are available in the latest minor versions of the affected series.
MariaDB has released security updates for several server versions to address CVE-2026-92262, a critical vulnerability rated 9.9 on the CVSS scale. The flaw impacts MariaDB server versions 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, and 11.8.1 through 11.8.8. According to the National Vulnerability Database, the issue stems from how the server handles table names with the #mysql50# prefix. This prefix allows attackers to bypass normal table-name filesystem encoding, leading to potential remote code execution.
In plain English
The vulnerability arises because MariaDB incorrectly processes table names that start with the #mysql50# prefix. This prefix is intended to handle legacy compatibility, but it fails to apply standard filesystem encoding rules. An attacker can create or reference a table using this specific prefix to access files under their original, unencoded names. This bypass allows the server to read or write to files it should not be able to touch, potentially causing crashes, data corruption, or the theft of sensitive information.
The background
MariaDB is a community-developed fork of the MySQL server, widely used in database management systems. The National Vulnerability Database categorizes this issue under CWE-706, which relates to improper handling of special elements in identifiers. The flaw has been present since version 10.6.1 and persists across multiple major release lines until the specific patched versions are applied. The severity is critical because it allows for remote code execution.
What changes now
Vendors have released fixes in the following versions: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. These updates correct the filesystem encoding logic for the #mysql50# prefix. Organizations running any of the affected versions must upgrade to these specific releases to mitigate the risk. No workaround has been confirmed by the vendor other than applying the patch.
Who needs to act first
Teams should prioritize updating systems that are exposed to the internet or internal networks where untrusted users can create tables. Before applying the patch, verify that the database is not in a critical transaction state and back up all data. Test the update in a non-production environment to ensure compatibility with existing applications. If immediate patching is impossible, restrict network access to the database ports and monitor for unusual table creation activity.
What to do and how to stay safe
- Inventory all MariaDB servers to identify those running affected versions.
- Apply the latest security patches for your specific major version series.
- Monitor database logs for attempts to create tables with the #mysql50# prefix.
- Restrict network access to database ports to trusted application servers only.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which MariaDB versions are affected by CVE-2026-92262?
Versions 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, and 11.8.1 through 11.8.8 are affected.
Is there a fix available for this vulnerability?
Yes, fixes are available in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
What is the severity of this vulnerability?
The National Vulnerability Database rates CVE-2026-92262 as Critical with a CVSS score of
