Closing the MariaDB CVE-2026-97380 Exception Queue

MariaDB has addressed a vulnerability, CVE-2026-97380, by closing the exception queue. This flaw allowed a low-privileged attacker to change passwords for other accounts using a GRANT PROXY statement with an empty password and a wrong grantor's privileges. The vulnerability affected six major release lines of MariaDB, from versions 10.6.1 to 13.0.1. The vendor has released patched versions (10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2).

To remedy this issue, affected systems should verify whether low-privileged accounts could execute administrative statements and whether proxy-era grants still exist after the upgrade. Low-privilege accounts should be reviewed for their ability to issue administrative commands. A workaround suggested by the advisory involves using random, non-guessable account names, but this is only a temporary solution requiring audit evidence.

To ensure the closure of the exception queue, a comprehensive record must be maintained. This record should list every affected asset, the fixed release version, and the individual who confirmed the patch. Exceptions should include details on the system, owner, business reason, network restrictions, and the expiration date of the granted exception.

Additionally, the review process should address any missing audit coverage and any unexpected password changes compared to change tickets and source networks. The final closure record should demonstrate that the vulnerable statement path is restricted by network and account controls, and the engine will be replaced by the specified date.

It is essential to recheck the exception queue after autoscaling, restore tests, and scheduled maintenance to ensure a durable release control system.