MariaDB fixes CVE-2026-97380 privilege flaw rated 8.8

MariaDB patched CVE-2026-97380 (CVSS 8.8), where an empty-password clause in GRANT PROXY caused servers to check the wrong grantor privileges, letting a low-privileged attacker change another account's password. Fixes shipped in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.

• Flaw spans six release lines, from 10.6.1–10.6.27 to 13.0.1
• Fixed releases: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2
• CVSS 3.1 score of 8.8, network access with no user interaction
• CISA listed no known exploitation as of October 28