External risk intelligence

MariaDB Table Name Bypass Allows Sensitive File Access and Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-92262

MariaDB is a database server typically deployed in internal, protected segments behind application servers. While databases communicate over networks, they are rarely exposed directly to the public internet in standard deployments, as they usually require internal network access or specific application-tier connectivity.

Remote Code Execution

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in MariaDB server allows an attacker to bypass normal table-name encoding, potentially leading to system crashes, data corruption, data exfiltration, or remote code execution. This issue affects specific versions of the software, and fixes are available in later releases.

Allows attackers to bypass table name encoding.
High risk of data loss or compromise.
Verify relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker with low-privileged access to a vulnerable MariaDB server could craft a special table name to bypass normal encoding. This allows them to reference files using their original, unencoded names, potentially leading to serious consequences.

Requires low-privileged access.
Triggered by a specially crafted table name.
Risk of data compromise or system compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, specially crafted table names could bypass filesystem encoding, potentially leading to unauthorized file access and system instability.

MariaDB database files could be accessed.
A specially crafted table name could trigger bypass.
Data corruption, exfiltration, or system crashes.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MariaDB server vulnerability requires a coordinated effort. Application owners are typically responsible for the services running on the database, while infrastructure or platform teams manage the underlying database instances. Network and security teams should also be involved to assess external exposure and implement any necessary network controls. The immediate first step is to locate all instances of the affected MariaDB server versions, confirm their accessibility and business criticality, and then engage the accountable system owners to plan remediation based on the assessed risk.

Database administrators and platform owners are responsible.
Verify all affected MariaDB server instances.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MariaDB server?

MariaDB is a widely used open-source relational database server, originally created as a community-developed fork of MySQL. It serves as the primary data storage engine for countless web applications, content management systems, and enterprise services, managing structured information and ensuring data persistence across various software environments.

How does the #mysql50# bypass work in CVE-2026-92262?

This vulnerability involves a weakness class known as CWE-706, or use of an incorrect pointer in a sensitive context. The #mysql50# prefix is a legacy feature intended to handle older file naming conventions. In affected versions, this prefix incorrectly bypasses modern filesystem encoding protections, allowing the database to mistakenly interact with files it should not be able to access, leading to critical security impacts.

Do I need special access to trigger this MariaDB bug?

Yes, an attacker must have at least low-privileged access to the MariaDB server to successfully exploit this flaw. The issue is triggered by the attacker crafting and submitting a specific table name containing the #mysql50# prefix. It cannot be triggered by simply interacting with standard, legitimate table names that do not utilize this specific legacy prefix.

Is my MariaDB instance likely to be reachable by attackers?

According to Halo Surface Signal, it is unlikely for most MariaDB instances to be directly exposed to the internet. These databases are typically kept within internal, protected network segments, communicating primarily with application servers rather than the public web. However, you should still confirm if your specific deployment allows any form of external or untrusted network reachability.

What should I do if I run an affected version of MariaDB?

Your first step is to inventory your environment to identify any instances running the affected MariaDB versions. Once identified, coordinate with the system owners to prioritize and schedule an update to the corrected releases, such as 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2, which contain the necessary fixes for this vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.