RHSA-2026:84689HighCVSS 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 19, 2026
Last Modified
October 20, 2026

🔗 CVE IDs covered (12)

CVE-2026-85745 →CVE-2026-86047 →CVE-2026-107814 →CVE-2026-107815 →CVE-2026-107817 →CVE-2026-107818 →CVE-2026-107823 →CVE-2026-85985 →CVE-2026-97380 →CVE-2026-107816 →CVE-2026-107821 →CVE-2026-107822 →

📋 Description

CVE-2026-85745 — mariadb: mariadb: out-of-bounds read in ST_Area with crafted MULTIPOLYGON CVE-2026-85985 — mariadb: MariaDB: Unauthorized file access via CONNECT engine functions CVE-2026-86047 — mariadb: mariadb: SQL injection via improper identifier quoting CVE-2026-97380 — mariadb: mariadb: Privilege escalation via empty password in GRANT PROXY statement CVE-2026-107814 — mariadb: mariadb: Arbitrary code execution via insecure service account home directory CVE-2026-107815 — mariadb: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write CVE-2026-107816 — mariadb: mariadb: Information disclosure via embedded null bytes in query cache plugin CVE-2026-107817 — mariadb: mariadb: Denial of Service via invalid binary JSON in mysql_json plugin CVE-2026-107818 — mariadb: mariadb: Privilege escalation via environment variable injection during service restart CVE-2026-107821 — mariadb: mariadb: Arbitrary code execution via crafted FRM metadata CVE-2026-107822 — mariadb: MariaDB: Privilege escalation via ACL cache key collision CVE-2026-107823 — mariadb: mariadb: Privilege escalation via unescaped newlines in view parser

🎯 Affected products62

  • Red Hat Hardened Images
  • mariadb11.8-0:11.8.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mariadb11.8-0:11.8.9-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • mariadb11.8-0:11.8.9-0.1.hum1@src as a component of Red Hat Hardened Images
  • mariadb11.8-0:11.8.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mariadb11.8-backup-0:11.8.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mariadb11.8-backup-0:11.8.9-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • mariadb11.8-backup-0:11.8.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mariadb11.8-client-utils-0:11.8.9-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • mariadb11.8-client-utils-0:11.8.9-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • mariadb11.8-client-utils-0:11.8.9-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • mariadb11.8-common-0:11.8.9-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • mariadb11.8-common-0:11.8.9-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • mariadb11.8-common-0:11.8.9-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • mariadb11.8-connect-engine-0:11.8.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mariadb11.8-connect-engine-0:11.8.9-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • mariadb11.8-connect-engine-0:11.8.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mariadb11.8-cracklib-password-check-0:11.8.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mariadb11.8-cracklib-password-check-0:11.8.9-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • mariadb11.8-cracklib-password-check-0:11.8.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mariadb11.8-devel-0:11.8.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mariadb11.8-devel-0:11.8.9-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • mariadb11.8-devel-0:11.8.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mariadb11.8-duckdb-engine-0:11.8.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mariadb11.8-duckdb-engine-0:11.8.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mariadb11.8-embedded-0:11.8.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mariadb11.8-embedded-0:11.8.9-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • mariadb11.8-embedded-0:11.8.9-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • mariadb11.8-embedded-devel-0:11.8.9-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • mariadb11.8-embedded-devel-0:11.8.9-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • +32 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Restrict network access to the MariaDB service so that only trusted client systems or the local host can connect. 1. If the database is only accessed locally, configure MariaDB to listen exclusively on localhost by editing `/etc/my.cnf.d/mariadb-server.cnf` under the `[mysqld]` section: ``` bind-address = 127.0.0.1 ``` Then restart the MariaDB service: ``` systemctl restart mariadb ``` 2. If remote access is necessary, use firewalld to block untrusted networks and permit access only from designated IP addresses or subnets: ``` firewall-cmd --permanent --remove-service=mariadb firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" service name="mariadb" accept' firewall-cmd --reload ``` Caveats: Restricting network reachability limits exposure to authorized networks and prevents untrusted network users from connecting, but it does not protect against malicious queries executed by already authenticated database accounts on permitted networks. Warning: Modifying firewall rules or binding addresses requires reloading firewall configurations or restarting the MariaDB service, which will terminate existing database connections and disrupt active services. Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to ensure strict identifier quoting and literal escaping during SQL serialization and avoid executing unverified database dumps with elevated privileges: upgrade to mariadb 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2 (or the fixed Mariadb/Mariadb:10.11/Mariadb/Mariadb:10.3/Mariadb/Mariadb Devel:10.3/Mariadb/Mariadb:11.8/Mariadb builds), which quote identifiers and escape string literals during statement serialization in SHOW commands and mariadb-dump, closing all 4 injection vectors (crafted username or hostname in SHOW CREATE USER, crafted foreign key constraint name in SHOW CREATE TABLE, crafted option name or foreign data wrapper in SHOW CREATE SERVER, crafted database object names or literals exported via mariadb-dump). Until patched, this is a concern on MariaDB environments where low-privileged users can define database objects and administrators run exported SQL dumps, so restrict database object creation privileges for untrusted accounts and avoid executing exported SQL dumps or SHOW command output with administrative credentials. As a compensating measure, enable audit logging to detect unauthorized privilege and role modifications when SQL dumps are executed, monitor and alert on unintended administrative privilege assignments resulting from executing injected SQL, and restrict database permissions so unprivileged users cannot create or alter database objects. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper identifier quoting defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high) Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce strict grantor privilege checks when parsing GRANT PROXY statements containing empty authentication clauses in MariaDB: upgrade to mariadb 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2 (or the fixed Mariadb/Mariadb:10.11/Mariadb/Mariadb:10.3/Mariadb/Mariadb Devel:10.3/Mariadb/Mariadb:11.8/Mariadb builds), which check whether the auth pointer exists rather than checking string lengths in LEX_USER::has_auth() and remove extraneous USER_AUTH allocation in the parser, closing GRANT PROXY statement with empty IDENTIFIED password clause. Until patched, this is a concern on all MariaDB deployments allowing low-privileged authenticated database access, so use random and non-guessable database user account names and restrict access for untrusted database accounts. As a compensating measure, audit database account authorization changes to detect unauthorized modification of user passwords and proxy privileges, forward administrative SQL operations including GRANT PROXY to a SIEM for alerting on privilege escalation attempts, and alert on unexpected proxy privileges or role assignments to detect unauthorized account compromise. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper authorization check defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1006 Privilege Change Audit Logging (medium) Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (16)