CVE-2026-102523: Unauthorized Table File Access in MariaDB

CVE-2026-102523 is a privilege escalation flaw in MariaDB residing in the ALTER TABLE ... CONVERT ... PARTITION command. The vulnerability affects MariaDB from version 10.11.1 through 13.0. The issue is that the operation does not properly apply filename encoding to user-supplied partition names before using them in filesystem path construction, allowing authenticated database users to manipulate the filesystem and access table files for which they have no authorization.

The severity is CVSS 8.0, classified as HIGH. The vulnerability requires database authentication but does not require initial elevated privileges: any database user can exploit it to read or modify data from other tables. The CVE was published to NVD on 2026-11-05. In the following days, social media signals confirmed awareness of the flaw in the industry. Patched versions are available immediately.

Database administration teams should: 1) Audit users with ALTER TABLE privileges and apply the principle of least privilege. 2) Plan upgrades to patched versions (10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2) on regular maintenance schedules. 3) Monitor database logs for ALTER TABLE CONVERT PARTITION commands and verify whether there have been any suspicious cross-partition access attempts. 4) If immediate updates are not feasible, severely restrict which users can perform partition operations.