Containers and managed MariaDB services need CVE-2026-85745 provenance checks
Containers and managed MariaDB services need CVE-2026-85745 provenance checks
A database version printed during a patch project may not match every copy of MariaDB in an environment. Containers, managed services, embedded appliances, and recovery images can run different builds. CVE-2026-85745 makes build provenance part of vulnerability response because six release lines are affected and an older image can return during an otherwise successful deployment.
The flaw is an out-of-bounds read in ST_Area() when MariaDB processes an invalid WKB MultiPolygon. The parser advances past a nested geometry header without first confirming enough input remains. A low-privilege authenticated SQL user can reach the path, and the base CVSS score is 4.3.
Know which MariaDB is running
The vendor lists affected versions from 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1. The fixes are 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
For a native installation, query the running server version and retention path. For a container, connect the service label to the exact image digest, then inspect the binary version inside that image. For a managed service, retain the provider's patch notice and maintenance record. For an appliance, ask the vendor how its bundled MariaDB build is updated.
An inventory that records only "MariaDB" cannot answer any of those questions. Include branch, full version, package origin, image digest, deployment owner, and last verified time.
Prevent rollback to a vulnerable layer
Blue-green deployment and failover plans can reactivate old capacity. After updating production, verify that the standby, warm replica, and rollback image use a fixed MariaDB release. Automated infrastructure definitions can otherwise recreate a vulnerable process even when the current running host reports a safe version.
Store the patch evidence with the deployment object. A digest or image identifier provides stronger provenance than a screenshot of a version string, but the version check is still needed to confirm what the application actually started. Check both.
Review reachability
The vulnerability needs an authenticated session, not an anonymous query. A container that accepts public geometry uploads can still forward attacker-controlled data under its database service identity. Determine which paths call ST_Area() and whether they consume external WKB.
Disable or do not grant spatial function access to applications that do not need it. This narrows the number of reachable inputs. MariaDB says there is no workaround, so access restriction does not replace a fixed image.
Interpret external exposure
A current ZoomEye search for app="MariaDB" returned 5,116,420 matches. This is an internet product-fingerprint count. It does not reveal container digest, exact branch, or a vulnerable function path.
The Filter query vul.cve="CVE-2026-85745" returned zero. That is a scoped index observation. It is not evidence that internal or managed databases are patched, and it cannot reconcile a mixed container fleet.
Testing the service path
After upgrading an image, test ST_Area() through the same connection path used by the application. Include successful calculations for representative MultiPolygon values and clean errors for malformed WKB. Verify the result through a load balancer and one failover candidate. If the application relies on a database driver with geometry handling, confirm that it does not transform data into a format that bypasses expected validation.
Check logs for repeated parsing failures and for services still connecting with the old user, driver, or schema. A rollout that leaves an old pod in the service selector should show up in both version evidence and runtime error data.
Completion evidence
The fixed release must be present in every place ST_Area() can execute. For a container platform, that means image provenance, running digest, service version, and redeployment behavior. For a managed service, it means a provider confirmation and an application-level check. For a recovery path, it means proof that restored capacity still runs the fixed binary.
Red Hat's record describes the memory disclosure as supporting an ASLR bypass and a later privilege escalation chain. That makes CVE-2026-85745 a concise test of patch provenance: knowing the current host is not enough when deployment machinery can bring an older MariaDB layer back.
References
- MariaDB advisory GHSA-p7v9-24h4-mch8
- CVE-2026-85745 record
- Red Hat security tracking
- MariaDB 12.3.3 release notes
Closing the MariaDB CVE-2026-97380 Exception Queue
Closing the MariaDB CVE-2026-97380 Exception Queue
Exception queues can outlive the vulnerability they were meant to cover. MariaDB CVE-2026-97380 is a good case for a closure discipline. A GRANT PROXY statement with IDENTIFIED and an empty password caused affected server releases to check the wrong grantor privileges. The vendor says a low-privileged attacker who can name another account may use the flaw to set that account's password.
The CNA gives the vulnerability a CVSS 3.1 score of 8.8 with network access, low complexity, low privileges and no user interaction. The affected range crosses six release lines, so a simple “production is patched” statement is insufficient unless every database role and deployment artifact is included.
Enumerate affected and fixed releases
Versions 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2 and 13.0.1 are listed as affected. Fixed releases are 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
Build the closure list from actual process evidence and managed-service records. Include replicas, read-only backups, developer databases and recovery environments. If an exception was granted before the patch, state the precise system, owner, business reason, network restriction and expiration date.
Close the authorization path
The vulnerable condition is the empty-password clause in GRANT PROXY, combined with an incorrect grantor-privilege check. Review whether low-privilege accounts can issue administrative statements and whether proxy-era grants remain after the upgrade. Remove authority that has no current owner.
The advisory adds a workaround: random, non-guessable account names prevent the stated password-change path because the attacker cannot name the target. This is not a patched binary and its value depends on secrecy. Audit where account names are stored, and make the workaround temporary.
Require account-change evidence
Review database audit and authentication records for the interval when an affected engine served traffic. Compare unexpected password changes with change tickets and source networks. The absence of an alert can be explained by missing audit coverage; record that gap rather than treating it as a clean result.
CISA's SSVC snapshot on 2026-10-28 listed exploitation as none and automatable as no. The evidence available does not identify a confirmed victim. That lowers the basis for claiming an incident, but it does not answer whether a particular environment processed a crafted statement.
Use exposure counts as leads
ZoomEye returned 5,116,358 matches for app="MariaDB" and zero for vul.cve="CVE-2026-97380". The product count is not a confirmed vulnerable population, and the filter result is not proof that no affected asset exists. Keep external visibility separate from internal version and account evidence.
Make the final record useful
A good closure record names every affected asset, the fixed release it now runs and the person who verified it. It includes account-change review results, open logging gaps and exceptions that remain. For each exception, show that the vulnerable statement path is constrained by network and account controls and specify the date the engine will be replaced.
Recheck the queue after autoscaling, restore tests and scheduled maintenance. An asset that enters service with an old image should reopen the control gap even if the original record was closed. The objective is a durable release control that can prove both the patched engine and the absence of unnecessary authority.
References
- MariaDB advisory
- CVE-2026-97380
- Patch commit
- ZoomEye product search
MariaDB exposure is not proof of CVE-2026-92262 compromise
MariaDB exposure is not proof of CVE-2026-92262 compromise
Internet measurements can show that MariaDB is common. They cannot tell an incident responder which servers are running an affected release or which tables have entered the vulnerable #mysql50# naming path. CVE-2026-92262 is a critical 9.9 vulnerability, and the response has to keep exposure, patched status, and compromise evidence on separate lines.
Read the measurement correctly
A ZoomEye search run on 2026-10-28 using app="MariaDB" returned 5,116,358 product-fingerprint matches. A separate query using vul.cve="CVE-2026-92262" returned 0. The first number describes a product population. The second describes the CVE index at that time. Neither result confirms that an individual system is vulnerable, exploited, or holding sensitive data.
The vendor's affected-version matrix is the right basis for software status. Versions 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1 are affected. The fixed releases are 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Separate the decision states
An external asset can be classified as MariaDB, unknown version, affected version, fixed version, or not enough evidence. A database with a valid connection record and a matching package version can be treated as affected or fixed with local proof. A banner or product fingerprint without version detail belongs in the unknown group.
Compromise evidence requires more. The Jira record demonstrates how a compatibility name can collide with a normal table name. An investigation should look for a suspicious name, an unexpected object change, a cross-tenant result, a data-integrity mismatch, or a crash that aligns with the vulnerable path. The presence of MariaDB alone does not supply any of those facts.
Use exposure to rank work
Internet-facing databases, shared tenant clusters, and systems with broad application credentials deserve early review. Restrict database ports to approved networks where possible. Inventory connection routes and service accounts, then compare the live server version with the fixed release.
ZoomEye can support an external inventory, but a search filter must be described precisely. The 5,116,358 result for app="MariaDB" is a broad fingerprint count, not a victim count. The zero CVE-indexed result is not a clean bill of health. CVE indexing, banner visibility, and product version reporting all affect what a search engine can observe.
Give stakeholders a defensible status
Report the protected endpoints, the remaining unknown endpoints, and the evidence source for each. A patched service with a live version check can be marked fixed. A host that merely responded to a product query should remain unknown until internal instrumentation supplies the package and runtime version.
MariaDB says no workaround is available for this flaw and advises immediate upgrades. That makes an affected build a clear action item. Incident response should proceed separately if there is evidence of unauthorized object access or modification.
Close the loop
After remediation, rerun the internal inventory and record the patched releases. Preserve the external exposure query and its timestamp for context, not as a completion certificate. If an unpatched host remains, document the business owner and the compensating network restriction.
CVE-2026-92262 is a serious database vulnerability. Sound reporting shows what is exposed, what is patched, and what evidence remains missing.
References
- MariaDB advisory GHSA-65jj-h265-3m7h
- MDEV-40362
- CERT-Bund advisory WID-SEC-2026-4018
github.com/MariaDB/server/blob/83e909fc2a0dbc394b…
なるほどー MariaDB+ prepared statementでtimeのバイト長が違うなどがわかった。
server: MAX_TIME_FULL_WIDTH
embedded MAX_TIME_WIDTH
67 views
Warning: 3 critical vulnerabilities in #MariaDB Server may allow low-privileged attackers to access or corrupt data, cause crashes, or execute code. CVE-2026-92262, CVE-2026-85746 & CVE-2026-85748 CVSS(3.1): 9.9. Read the advisory github.com/MariaDB/server/security/advisories/GHS… and #Patch #Patch #Patch
1 like · 135 views
Mentions
Containers and managed MariaDB services need CVE-2026-85745 provenance checks Containers and managed MariaDB services need CVE-2026-85745 provenance checks A database version printed during a patch project may not match every copy of MariaDB in an environment. Containers, managed services, embedded appliances, and recovery images can run different builds. CVE-2026-85745 makes build provenance part of vulnerability response because six release lines are affected and an older image can return during an otherwise successful deployment. The flaw is an out-of-bounds read in ST_Area() when MariaDB processes an invalid WKB MultiPolygon. The parser advances past a nested geometry header without first confirming enough input remains. A low-privilege authenticated SQL user can reach the path, and the base CVSS score is 4.3. Know which MariaDB is running The vendor lists affected versions from 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1. The fixes are 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. For a native installation, query the running server version and retention path. For a container, connect the service label to the exact image digest, then inspect the binary version inside that image. For a managed service, retain the provider's patch notice and maintenance record. For an appliance, ask the vendor how its bundled MariaDB build is updated. An inventory that records only "MariaDB" cannot answer any of those questions. Include branch, full version, package origin, image digest, deployment owner, and last verified time. Prevent rollback to a vulnerable layer Blue-green deployment and failover plans can reactivate old capacity. After updating production, verify that the standby, warm replica, and rollback image use a fixed MariaDB release. Automated infrastructure definitions can otherwise recreate a vulnerable process even when the current running host reports a safe version. Store the patch evidence with the deployment object. A digest or image identifier provides stronger provenance than a screenshot of a version string, but the version check is still needed to confirm what the application actually started. Check both. Review reachability The vulnerability needs an authenticated session, not an anonymous query. A container that accepts public geometry uploads can still forward attacker-controlled data under its database service identity. Determine which paths call ST_Area() and whether they consume external WKB. Disable or do not grant spatial function access to applications that do not need it. This narrows the number of reachable inputs. MariaDB says there is no workaround, so access restriction does not replace a fixed image. Interpret external exposure A current ZoomEye search for app="MariaDB" returned 5,116,420 matches. This is an internet product-fingerprint count. It does not reveal container digest, exact branch, or a vulnerable function path. The Filter query vul.cve="CVE-2026-85745" returned zero. That is a scoped index observation. It is not evidence that internal or managed databases are patched, and it cannot reconcile a mixed container fleet. Testing the service path After upgrading an image, test ST_Area() through the same connection path used by the application. Include successful calculations for representative MultiPolygon values and clean errors for malformed WKB. Verify the result through a load balancer and one failover candidate. If the application relies on a database driver with geometry handling, confirm that it does not transform data into a format that bypasses expected validation. Check logs for repeated parsing failures and for services still connecting with the old user, driver, or schema. A rollout that leaves an old pod in the service selector should show up in both version evidence and runtime error data. Completion evidence The fixed release must be present in every place ST_Area() can execute. For a container platform, that means image provenance, running digest, service version, and redeployment behavior. For a managed service, it means a provider confirmation and an application-level check. For a recovery path, it means proof that restored capacity still runs the fixed binary. Red Hat's record describes the memory disclosure as supporting an ASLR bypass and a later privilege escalation chain. That makes CVE-2026-85745 a concise test of patch provenance: knowing the current host is not enough when deployment machinery can bring an older MariaDB layer back. References - MariaDB advisory GHSA-p7v9-24h4-mch8 - CVE-2026-85745 record - Red Hat security tracking - MariaDB 12.3.3 release notes
Closing the MariaDB CVE-2026-97380 Exception Queue Closing the MariaDB CVE-2026-97380 Exception Queue Exception queues can outlive the vulnerability they were meant to cover. MariaDB CVE-2026-97380 is a good case for a closure discipline. A GRANT PROXY statement with IDENTIFIED and an empty password caused affected server releases to check the wrong grantor privileges. The vendor says a low-privileged attacker who can name another account may use the flaw to set that account's password. The CNA gives the vulnerability a CVSS 3.1 score of 8.8 with network access, low complexity, low privileges and no user interaction. The affected range crosses six release lines, so a simple “production is patched” statement is insufficient unless every database role and deployment artifact is included. Enumerate affected and fixed releases Versions 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2 and 13.0.1 are listed as affected. Fixed releases are 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Build the closure list from actual process evidence and managed-service records. Include replicas, read-only backups, developer databases and recovery environments. If an exception was granted before the patch, state the precise system, owner, business reason, network restriction and expiration date. Close the authorization path The vulnerable condition is the empty-password clause in GRANT PROXY, combined with an incorrect grantor-privilege check. Review whether low-privilege accounts can issue administrative statements and whether proxy-era grants remain after the upgrade. Remove authority that has no current owner. The advisory adds a workaround: random, non-guessable account names prevent the stated password-change path because the attacker cannot name the target. This is not a patched binary and its value depends on secrecy. Audit where account names are stored, and make the workaround temporary. Require account-change evidence Review database audit and authentication records for the interval when an affected engine served traffic. Compare unexpected password changes with change tickets and source networks. The absence of an alert can be explained by missing audit coverage; record that gap rather than treating it as a clean result. CISA's SSVC snapshot on 2026-10-28 listed exploitation as none and automatable as no. The evidence available does not identify a confirmed victim. That lowers the basis for claiming an incident, but it does not answer whether a particular environment processed a crafted statement. Use exposure counts as leads ZoomEye returned 5,116,358 matches for app="MariaDB" and zero for vul.cve="CVE-2026-97380". The product count is not a confirmed vulnerable population, and the filter result is not proof that no affected asset exists. Keep external visibility separate from internal version and account evidence. Make the final record useful A good closure record names every affected asset, the fixed release it now runs and the person who verified it. It includes account-change review results, open logging gaps and exceptions that remain. For each exception, show that the vulnerable statement path is constrained by network and account controls and specify the date the engine will be replaced. Recheck the queue after autoscaling, restore tests and scheduled maintenance. An asset that enters service with an old image should reopen the control gap even if the original record was closed. The objective is a durable release control that can prove both the patched engine and the absence of unnecessary authority. References - MariaDB advisory - CVE-2026-97380 - Patch commit - ZoomEye product search
MariaDB exposure is not proof of CVE-2026-92262 compromise MariaDB exposure is not proof of CVE-2026-92262 compromise Internet measurements can show that MariaDB is common. They cannot tell an incident responder which servers are running an affected release or which tables have entered the vulnerable #mysql50# naming path. CVE-2026-92262 is a critical 9.9 vulnerability, and the response has to keep exposure, patched status, and compromise evidence on separate lines. Read the measurement correctly A ZoomEye search run on 2026-10-28 using app="MariaDB" returned 5,116,358 product-fingerprint matches. A separate query using vul.cve="CVE-2026-92262" returned 0. The first number describes a product population. The second describes the CVE index at that time. Neither result confirms that an individual system is vulnerable, exploited, or holding sensitive data. The vendor's affected-version matrix is the right basis for software status. Versions 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, 12.3.1 through 12.3.2, and 13.0.1 are affected. The fixed releases are 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Separate the decision states An external asset can be classified as MariaDB, unknown version, affected version, fixed version, or not enough evidence. A database with a valid connection record and a matching package version can be treated as affected or fixed with local proof. A banner or product fingerprint without version detail belongs in the unknown group. Compromise evidence requires more. The Jira record demonstrates how a compatibility name can collide with a normal table name. An investigation should look for a suspicious name, an unexpected object change, a cross-tenant result, a data-integrity mismatch, or a crash that aligns with the vulnerable path. The presence of MariaDB alone does not supply any of those facts. Use exposure to rank work Internet-facing databases, shared tenant clusters, and systems with broad application credentials deserve early review. Restrict database ports to approved networks where possible. Inventory connection routes and service accounts, then compare the live server version with the fixed release. ZoomEye can support an external inventory, but a search filter must be described precisely. The 5,116,358 result for app="MariaDB" is a broad fingerprint count, not a victim count. The zero CVE-indexed result is not a clean bill of health. CVE indexing, banner visibility, and product version reporting all affect what a search engine can observe. Give stakeholders a defensible status Report the protected endpoints, the remaining unknown endpoints, and the evidence source for each. A patched service with a live version check can be marked fixed. A host that merely responded to a product query should remain unknown until internal instrumentation supplies the package and runtime version. MariaDB says no workaround is available for this flaw and advises immediate upgrades. That makes an affected build a clear action item. Incident response should proceed separately if there is evidence of unauthorized object access or modification. Close the loop After remediation, rerun the internal inventory and record the patched releases. Preserve the external exposure query and its timestamp for context, not as a completion certificate. If an unpatched host remains, document the business owner and the compensating network restriction. CVE-2026-92262 is a serious database vulnerability. Sound reporting shows what is exposed, what is patched, and what evidence remains missing. References - MariaDB advisory GHSA-65jj-h265-3m7h - MDEV-40362 - CERT-Bund advisory WID-SEC-2026-4018
github.com/MariaDB/server/blob/83e909fc2a0dbc394b… なるほどー MariaDB+ prepared statementでtimeのバイト長が違うなどがわかった。 server: MAX_TIME_FULL_WIDTH embedded MAX_TIME_WIDTH
Warning: 3 critical vulnerabilities in #MariaDB Server may allow low-privileged attackers to access or corrupt data, cause crashes, or execute code. CVE-2026-92262, CVE-2026-85746 & CVE-2026-85748 CVSS(3.1): 9.9. Read the advisory github.com/MariaDB/server/security/advisories/GHS… and #Patch #Patch #Patch