MariaDB Table Name Encoding Bypass via the Historic #mysql50# Prefix in CVE-2026-92262
Contents
Overview
| Item | Details |
|---|---|
| CVE | CVE-2026-92262 |
| Target | MariaDB Server (community fork of MySQL) |
| Severity | CVSS v3.1 9.9 (Critical, evaluated by GitHub as the CNA) |
| Cause | Table names with the legacy #mysql50# prefix bypass standard file name encoding |
| Impact | Potential crashes, data corruption, data exfiltration, and remote code execution |
| Attack prerequisites | Network accessible, low-privileged account required, no user interaction required |
| Workaround | None. Upgrading to a patched version is the only fix |
| Patched versions | 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2 |
The CVE record was published on October 16, 2026, with its latest update on October 21, 2026.
As of November 7, 2026, about three weeks have passed since its publication.
However, the releases containing the fixes came out earlier, between August and September 2026, meaning instances upgraded since that window are likely already patched.
This CVE was issued as an advisory specifically for MariaDB.
All primary sources referenced here cover only MariaDB Server, leaving unstated whether Oracle MySQL is affected.
Because we cannot assume MySQL shares the exact same flaw, this post focuses strictly on MariaDB.
Mapping Between Table Names and File Names
MariaDB stores tables as files inside its data directory.
Because table names can include characters inconvenient or invalid in file names, MariaDB encodes table names (converting them into safe strings) when storing them.
According to the example in the GitHub Security Advisory, a table named a-b is stored under a file name like a@002db.
Here, the hyphen is replaced with @002d.
However, prefixing a table name with #mysql50# prevents this encoding from happening.
The name #mysql50#a-b maps directly to the unencoded file a-b.
The advisory explains that this mechanism was originally designed to read tables created in MySQL 5.0 before file name encoding was introduced.
flowchart LR
A["Table name a-b"] --> B["Encode"] --> C["File a@002db"]
D["Table name #mysql50#a-b"] --> E["Do not encode"] --> F["File a-b"]The advisory is titled “Multiple issues due to historical #mysql50# table name encoding bypass”, consolidating various problems derived from this loophole into a single CVE rather than treating them as an isolated bug.
The CVE record classifies the weakness as CWE-706 (Use of Incorrectly-Resolved Name or Reference).
Reported Specific Behaviors
The underlying ticket that prompted the fix, MDEV-40362, is titled “#mysql50# is confused with table name in table cache and on disk”.
The table cache is the server mechanism that retains metadata of opened tables in memory.
In the reproduction steps in the ticket, a user creates a table named t using the MEMORY engine, followed by creating an alias-like table named #mysql50#t and inserting data into it.
When executing SELECT on t afterwards, the server returns the rows inserted into #mysql50#t.
Even though they should be distinct tables, data from one becomes visible from the other.
The issue was reported by Ben Bidner of the Automattic security team; the ticket was created on July 13, 2026, and marked resolved on July 22.
As a derivative issue of MDEV-40362, MDEV-41480—where a failed ADD PARTITION with a #mysql50#-prefixed partition name causes the entire table to disappear—is also linked to the ticket.
The advisory lists four impacts: crash, data corruption, data exfiltration, and remote code execution.
However, neither the advisory nor the ticket details an attack procedure showing which specific operations lead to which impact.
Remote code execution is listed as a potential consequence rather than a disclosed, weaponized exploit.
Prerequisites for Exploitation
The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Breaking this down: the flaw is exploitable over the network (AV:N), has low attack complexity (AC:L), requires low-privileged credentials (PR:L), and needs no user interaction (UI:N).
The changed scope (S:C) indicates that the impact may extend beyond MariaDB itself to other components.
This is not an unauthenticated remote flaw; holding some database account is a prerequisite.
The advisory does not explicitly define exactly which privileges are required.
However, because the reproduction steps in MDEV-40362 involve creating and writing to tables, at least that scenario requires privileges to create tables.
Environments where accounts are provisioned per user on a shared database server, or setups where an application’s database account is compromised via web vulnerabilities, readily satisfy this “low privilege” condition.
Regarding active exploitation, CISA’s assessment (SSVC) attached to the CVE record lists exploitation as “none” and automatable as “no”.
This reflects the determination at the time of CISA’s review and may change over time.
Affected Versions and Patched Releases
The affected range matches between the CVE record and the advisory.
The release dates for the patched versions correspond to the dates published in MariaDB’s official release notes.
| Release Series | Affected Versions | Patched Version | Release Date |
|---|---|---|---|
| 10.6 | 10.6.1 to 10.6.27 | 10.6.28 | August 13, 2026 |
| 10.11 | 10.11.1 to 10.11.18 | 10.11.19 | August 24, 2026 |
| 11.4 | 11.4.1 to 11.4.12 | 11.4.13 | August 24, 2026 |
| 11.8 | 11.8.1 to 11.8.8 | 11.8.9 | August 24, 2026 |
| 12.3 | 12.3.1 to 12.3.2 | 12.3.3 | August 24, 2026 |
| 13.0 | 13.0.1 | 13.0.2 | September 15, 2026 |
The release notes for 10.6.28, 10.11.19, 11.4.13, 11.8.9, and 12.3.3 include CVE-2026-92262 (CVSS 9.9) in their security tables and cite MDEV-40362 under notable changes.
In contrast, the release notes for 13.0.2 contain no security section, and no mention of this CVE was found there.
The basis for classifying 13.0.2 as a fixed version rests on the patched versions list in the CVE record and the security advisory.
The 10.6 series warrants caution.
The release notes for 10.6.28 state that maintenance for the 10.6 series ended in July 2026, making 10.6.28 the final release for this branch.
While upgrading to 10.6.28 addresses this CVE, no future vulnerability fixes will be issued for 10.6.
Mitigation and Actions
The advisory notes that there are no workarounds and recommends upgrading immediately.
Because no configuration option is provided to disable #mysql50#, upgrading to one of the patched versions listed above is the only option.
You can verify the running version by connecting to MariaDB and executing SELECT VERSION();.
If MariaDB was installed via Linux distribution packages, backported fixes may be packaged under different version numbers, so check your distribution’s security tracker to confirm whether this CVE has been addressed.
Discrepancies in Published Dates
The reported dates for this CVE differ across various sources.
The CVE record was published on October 16, 2026, and updated on October 21.
On GitHub’s advisory page, the published date is listed as September 7, 2026.
The patched releases themselves appeared between August 13 and September 15, with the CVE publication following later.
Patched releases were distributed first, followed by the public disclosure of the vulnerability details.
If updates are postponed because release notes lack immediate security fanfare or when waiting for public advisories, a CVSS 9.9 fix can easily be overlooked.