CVE-2026-107823: How a Crafted Username Becomes MariaDB Security Metadata

Vulnerability overview

CVE-2026-107823 is the lowest-scored flaw in the October 2026 MariaDB Server set at 7.2 under CVSS v3.1, and it is the one most likely to be misread as a rounding error beside the higher numbers in the same release. The flaw is a privilege escalation inside the database itself, disclosed in CSA Singapore alert AL-2026-144 together with CVE-2026-107814, CVE-2026-107815, CVE-2026-107818 and CVE-2026-107821.

Mechanism and exploitation conditions

The advisory describes the mechanism precisely. An authenticated user who holds both CREATE USER and CREATE VIEW WITH GRANT OPTION can create a crafted username containing additional view metadata. The parser then interprets part of that username as security metadata, which can allow the attacker to escalate database privileges.

This is metadata smuggling across a boundary the parser assumed was safe.…