{
  "id": 16954307,
  "title": "Closing the MariaDB CVE-2026-97380 Exception Queue",
  "url": "https://urgent.news/2026/10/28/closing-the-mariadb-cve-2026-97380-exception-queue",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-28T20:40:37.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/kozhevniko/closing-the-mariadb-cve-2026-97380-exception-queue-21ed"
  },
  "original_language": "en",
  "account": "MariaDB has addressed a vulnerability, CVE-2026-97380, by closing the exception queue. This flaw allowed a low-privileged attacker to change passwords for other accounts using a GRANT PROXY statement with an empty password and a wrong grantor's privileges. The vulnerability affected six major release lines of MariaDB, from versions 10.6.1 to 13.0.1. The vendor has released patched versions (10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2).\n\nTo remedy this issue, affected systems should verify whether low-privileged accounts could execute administrative statements and whether proxy-era grants still exist after the upgrade. Low-privilege accounts should be reviewed for their ability to issue administrative commands. A workaround suggested by the advisory involves using random, non-guessable account names, but this is only a temporary solution requiring audit evidence.\n\nTo ensure the closure of the exception queue, a comprehensive record must be maintained. This record should list every affected asset, the fixed release version, and the individual who confirmed the patch. Exceptions should include details on the system, owner, business reason, network restrictions, and the expiration date of the granted exception. Additionally, the review process should address any missing audit coverage and any unexpected password changes compared to change tickets and source networks. The final closure record should demonstrate that the vulnerable statement path is restricted by network and account controls, and the engine will be replaced by the specified date. It is essential to recheck the exception queue after autoscaling, restore tests, and scheduled maintenance to ensure a durable release control system.",
  "summary": "Closing the MariaDB CVE-2026-97380 Exception Queue Exception queues can outlive the vulnerability they were meant to cover. MariaDB CVE-2026-97380 is a good case for a closure discipline. A GRANT PROXY statement with IDENTIFIED and an empty password caused affected server releases to check the wrong grantor privileges. The vendor says a low-privileged attacker who can name another account may use…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}