Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
886 vulnerabilities by MariaDB
CVE-2026-107823 (GCVE-0-2026-107823)
Vulnerability from nvd – Published: 2026-10-09 17:30 – Updated: 2026-10-09 17:30
VLAI
EPSS
VEX
Title
MariaDB: privilege escalation via incorrect view frm parsing
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
7.2 (High)
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/8a642bc8… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40484 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-144",
"description": "CWE-144: Improper Neutralization of Line Delimiters",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:30:36.062Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37"
},
{
"name": "https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40484",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40484"
}
],
"source": {
"advisory": "GHSA-g2q2-3936-cp37",
"discovery": "UNKNOWN"
},
"title": "MariaDB: privilege escalation via incorrect view frm parsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107823",
"datePublished": "2026-10-09T17:30:36.062Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:30:36.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107822 (GCVE-0-2026-107822)
Vulnerability from nvd – Published: 2026-10-09 17:28 – Updated: 2026-10-09 17:28
VLAI
EPSS
VEX
Title
MariaDB: database privilege escalation via user / role name collision in the acl cache
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
6.4 (Medium)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/67ea07dd… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40541 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB\u0027s ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal\u0027s database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-706",
"description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:28:47.578Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf"
},
{
"name": "https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40541",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40541"
}
],
"source": {
"advisory": "GHSA-2m85-2x26-36rf",
"discovery": "UNKNOWN"
},
"title": "MariaDB: database privilege escalation via user / role name collision in the acl cache"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107822",
"datePublished": "2026-10-09T17:28:47.578Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:28:47.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107821 (GCVE-0-2026-107821)
Vulnerability from nvd – Published: 2026-10-09 17:27 – Updated: 2026-10-09 17:42
VLAI
EPSS
VEX
Title
MariaDB: insufficient validation of binary frm data when opening a table
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 17:42 UTC
CWE
- CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/3b1c2e58… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40571 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107821",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T17:42:08.587821Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:42:29.482Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1285",
"description": "CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:27:16.316Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5"
},
{
"name": "https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40571",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40571"
}
],
"source": {
"advisory": "GHSA-c4gx-34mg-95q5",
"discovery": "UNKNOWN"
},
"title": "MariaDB: insufficient validation of binary frm data when opening a table"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107821",
"datePublished": "2026-10-09T17:27:16.316Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:42:29.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107819 (GCVE-0-2026-107819)
Vulnerability from nvd – Published: 2026-10-09 17:25 – Updated: 2026-10-09 17:59
VLAI
EPSS
VEX
Title
MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure
Summary
MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 17:59 UTC
CWE
- CWE-297 - Improper Validation of Certificate with Host Mismatch
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_MISC |
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_MISC |
| https://jira.mariadb.org/browse/CONC-846 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107819",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T17:59:07.078424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:59:15.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.1, \u003c 3.4.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297: Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:25:45.082Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10"
},
{
"name": "https://jira.mariadb.org/browse/CONC-846",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/CONC-846"
}
],
"source": {
"advisory": "GHSA-fmq9-qjxj-qpf7",
"discovery": "UNKNOWN"
},
"title": "MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107819",
"datePublished": "2026-10-09T17:25:45.082Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:59:15.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107818 (GCVE-0-2026-107818)
Vulnerability from nvd – Published: 2026-10-09 17:23 – Updated: 2026-10-09 17:23
VLAI
EPSS
VEX
Title
MariaDB: environment injection via wsrep bootstrap in the mariadb.service file
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
8.4 (High)
CWE
- CWE-15 - External Control of System or Configuration Setting
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/e3d62d4e… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40629 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-15",
"description": "CWE-15: External Control of System or Configuration Setting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:23:58.543Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5"
},
{
"name": "https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40629",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40629"
}
],
"source": {
"advisory": "GHSA-mhvc-vqcq-7vq5",
"discovery": "UNKNOWN"
},
"title": "MariaDB: environment injection via wsrep bootstrap in the mariadb.service file"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107818",
"datePublished": "2026-10-09T17:23:58.543Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:23:58.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107817 (GCVE-0-2026-107817)
Vulnerability from nvd – Published: 2026-10-09 17:22 – Updated: 2026-10-09 17:22
VLAI
EPSS
VEX
Title
MariaDB: mysql_json plugin OOB reads
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
4.4 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/851f5247… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40678 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:22:19.290Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-89ph-64cf-gqcc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-89ph-64cf-gqcc"
},
{
"name": "https://github.com/MariaDB/server/commit/851f52470d470a96a66e0b7e5599f3b6c2e45907",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/851f52470d470a96a66e0b7e5599f3b6c2e45907"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40678",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40678"
}
],
"source": {
"advisory": "GHSA-89ph-64cf-gqcc",
"discovery": "UNKNOWN"
},
"title": "MariaDB: mysql_json plugin OOB reads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107817",
"datePublished": "2026-10-09T17:22:19.290Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:22:19.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107816 (GCVE-0-2026-107816)
Vulnerability from nvd – Published: 2026-10-09 17:19 – Updated: 2026-10-09 17:19
VLAI
EPSS
VEX
Title
MariaDB: `qc_info` plugin can do OOB reads if query contains \0
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
6.4 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/09319940… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40670 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:19:00.365Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6"
},
{
"name": "https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40670",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40670"
}
],
"source": {
"advisory": "GHSA-wfqg-88r5-55f6",
"discovery": "UNKNOWN"
},
"title": "MariaDB: `qc_info` plugin can do OOB reads if query contains \\0"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107816",
"datePublished": "2026-10-09T17:19:00.365Z",
"dateReserved": "2026-10-08T21:23:59.822Z",
"dateUpdated": "2026-10-09T17:19:00.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107815 (GCVE-0-2026-107815)
Vulnerability from nvd – Published: 2026-10-09 16:05 – Updated: 2026-10-09 16:05
VLAI
EPSS
VEX
Title
MariaDB: one byte OOB write in DOS tables of the CONNECT engine
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
8.5 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/b369925f… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40637 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine\u0027s DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:05:49.046Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq"
},
{
"name": "https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40637",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40637"
}
],
"source": {
"advisory": "GHSA-4wgx-ffg9-jrwq",
"discovery": "UNKNOWN"
},
"title": "MariaDB: one byte OOB write in DOS tables of the CONNECT engine"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107815",
"datePublished": "2026-10-09T16:05:49.046Z",
"dateReserved": "2026-10-08T21:23:59.822Z",
"dateUpdated": "2026-10-09T16:05:49.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107814 (GCVE-0-2026-107814)
Vulnerability from nvd – Published: 2026-10-09 16:02 – Updated: 2026-10-09 16:45
VLAI
EPSS
VEX
Title
MariaDB: Insecure $HOME in MariaDB rpm packages
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 16:16 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/d842d6e9… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T16:16:12.667573Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:45:15.295Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:02:25.544Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"
},
{
"name": "https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
}
],
"source": {
"advisory": "GHSA-m5gf-432r-g5jw",
"discovery": "UNKNOWN"
},
"title": "MariaDB: Insecure $HOME in MariaDB rpm packages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107814",
"datePublished": "2026-10-09T16:02:25.544Z",
"dateReserved": "2026-10-08T21:23:59.822Z",
"dateUpdated": "2026-10-09T16:45:15.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48165 (GCVE-0-2026-48165)
Vulnerability from nvd – Published: 2026-06-12 17:35 – Updated: 2026-08-03 12:05
VLAI
EPSS
VEX
Title
MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
13 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MariaDB | server |
Affected:
>= 10.6.1, < 10.6.27
Affected: >= 10.11.1, < 10.11.18 Affected: >= 11.4.1, < 11.4.12 Affected: >= 11.8.1, < 11.8.8 Affected: >= 12.3.1, < 12.3.2 |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 10) |
cpe:/o:redhat:enterprise_linux:10.2
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS (v. 10.0) |
cpe:/o:redhat:enterprise_linux_eus:10.0
|
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 8) |
cpe:/a:redhat:enterprise_linux:8::appstream
|
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 9) |
cpe:/a:redhat:enterprise_linux:9::appstream
|
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48165",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T03:55:56.312Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "galera-0:26.4.27-1.el10_2.aarch64",
"product": "Red Hat Enterprise Linux AppStream (v. 10)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "unaffected",
"packageName": "mariadb-3:10.11.18-1.el10_0.aarch64",
"product": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "unaffected",
"packageName": "Judy-0:1.0.5-18.module+el8.10.0+21221+7bee72c1.aarch64 (mariadb:10.11)",
"product": "Red Hat Enterprise Linux AppStream (v. 8)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "unaffected",
"packageName": "galera-0:26.4.27-1.module+el9.8.0+24388+85f1c439.aarch64 (mariadb:10.11)",
"product": "Red Hat Enterprise Linux AppStream (v. 9)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "mariadb10-11-main@aarch64",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-12T17:35:16.918Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in MariaDB server. A high-privileged MariaDB user could exploit this vulnerability by manipulating specific global system variables, namely wsrep_sst_receive_address or wsrep_sst_donor. This manipulation could allow the user to execute arbitrary shell commands as the user ID of the mariadbd process on a galera joiner node. The primary impact of this flaw is arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:05:49.897Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-48165"
},
{
"name": "RHBZ#2488458",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49522"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33093"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33464"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33482"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33481"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25145"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25143"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:49522: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:33093: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33412: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33464: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33482: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33481: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25145: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:25143: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T18:01:28.777Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-12T17:35:16.918Z",
"value": "Made public."
}
],
"title": "mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.27"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.18"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.12"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.8"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could\u0027ve used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:35:16.918Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-39676",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-39676"
}
],
"source": {
"advisory": "GHSA-7v3p-h23x-8hwv",
"discovery": "UNKNOWN"
},
"title": "MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48165",
"datePublished": "2026-06-12T17:35:16.918Z",
"dateReserved": "2026-05-20T23:12:43.032Z",
"dateUpdated": "2026-08-03T12:05:49.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48163 (GCVE-0-2026-48163)
Vulnerability from nvd – Published: 2026-06-12 17:34 – Updated: 2026-08-03 12:05
VLAI
EPSS
VEX
Title
MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
13 references
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| MariaDB | server |
Affected:
>= 10.6.1, < 10.6.27
Affected: >= 10.11.1, < 10.11.18 Affected: >= 11.4.1, < 11.4.12 Affected: >= 11.8.1, < 11.8.8 Affected: >= 12.3.1, < 12.3.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:10.11.18-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:11.8.8-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
3:10.11.18-1.el10_0 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
8100020260616102001.489197e6 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612104015.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612103452.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
11.8.8-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
10.11.18-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48163",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T03:55:55.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:10.11.18-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb11.8",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:11.8.8-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:10.11.18-1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8100020260616102001.489197e6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:11.8",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612104015.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612103452.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb11-8-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "11.8.8-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb10-11-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "10.11.18-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-12T17:34:57.923Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in MariaDB server. During the State Snapshot Transfer (SST) process, a malicious joiner node could exploit improper parameter validation on the donor node. This vulnerability, specifically within the rsync SST method, allows the malicious joiner to execute arbitrary shell commands on the donor server, leading to potential compromise of the system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:05:46.876Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-48163"
},
{
"name": "RHBZ#2488454",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49522"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33093"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33464"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33482"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33481"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25145"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25143"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:49522: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:33093: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33412: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33464: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33482: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33481: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25145: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:25143: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T18:01:12.767Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-12T17:34:57.923Z",
"value": "Made public."
}
],
"title": "mariadb: Arbitrary code execution via improper parameter validation during SST",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.27"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.18"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.12"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.8"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:34:57.923Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-39648",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-39648"
}
],
"source": {
"advisory": "GHSA-rpgv-q6gv-684r",
"discovery": "UNKNOWN"
},
"title": "MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48163",
"datePublished": "2026-06-12T17:34:57.923Z",
"dateReserved": "2026-05-20T23:12:43.032Z",
"dateUpdated": "2026-08-03T12:05:46.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44173 (GCVE-0-2026-44173)
Vulnerability from nvd – Published: 2026-06-12 17:34 – Updated: 2026-08-03 12:06
VLAI
EPSS
VEX
Title
MariaDB: FILE privilege was not checked for subqueries in the FROM clause
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Severity
5 (Medium)
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-12 18:03 UTC
Assigner
References
13 references
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| MariaDB | server |
Affected:
>= 10.6.1, < 10.6.26
Affected: >= 10.11.1, < 10.11.17 Affected: >= 11.4.1, < 11.4.11 Affected: >= 11.8.1, < 11.8.7 Affected: >= 12.3.1, < 12.3.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:10.11.18-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:11.8.8-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
8100020260616102001.489197e6 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612104015.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612103452.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
11.8.8-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
10.11.18-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-12T18:03:24.496133Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T18:03:34.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:10.11.18-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb11.8",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:11.8.8-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8100020260616102001.489197e6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:11.8",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612104015.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612103452.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb11-8-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "11.8.8-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb10-11-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "10.11.18-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-12T17:34:30.301Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in MariaDB server. This vulnerability allows a low-privileged authenticated user to bypass a security control that normally restricts file operations. Specifically, the system failed to verify the necessary \u0027FILE\u0027 privilege when certain \u0027SELECT\u0027 statements, which write data to files, were executed with subqueries in their \u0027FROM\u0027 clause. This could enable an attacker to write unauthorized files to the server\u0027s file system, potentially leading to the disclosure of sensitive information or a denial of service by corrupting or filling disk space."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:06:06.566Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-44173"
},
{
"name": "RHBZ#2488460",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488460"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49522"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33093"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33464"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33482"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33481"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25145"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25143"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:49522: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:33093: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33412: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33464: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33482: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33481: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25145: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:25143: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T18:01:36.157Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-12T17:34:30.301Z",
"value": "Made public."
}
],
"title": "mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.26"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.17"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.11"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.7"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:34:30.301Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-39493",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-39493"
}
],
"source": {
"advisory": "GHSA-667j-m53j-wpmc",
"discovery": "UNKNOWN"
},
"title": "MariaDB: FILE privilege was not checked for subqueries in the FROM clause"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44173",
"datePublished": "2026-06-12T17:34:30.301Z",
"dateReserved": "2026-05-05T14:39:34.923Z",
"dateUpdated": "2026-08-03T12:06:06.566Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44172 (GCVE-0-2026-44172)
Vulnerability from nvd – Published: 2026-06-12 17:34 – Updated: 2026-09-17 12:04
VLAI
EPSS
VEX
Title
MariaDB: mysql_real_escape_string() incorrectly handled big5
Summary
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-12 20:02 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://jira.mariadb.org/browse/CONC-819 | x_refsource_MISC |
| https://access.redhat.com/security/cve/CVE-2026-44172 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2488459 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
| https://access.redhat.com/errata/RHSA-2026:68567 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:47772 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:43505 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:30135 | vendor-advisoryx_refsource_REDHAT |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| MariaDB | server |
Affected:
= 3.3.18
Affected: = 3.4.8 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:3.4.4-2.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:3.4.4-1.el10_0.1 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
3.4.9-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-12T20:02:02.774991Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T20:02:12.617Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb-connector-c",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.4.4-2.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "mariadb-connector-c",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.4.4-1.el10_0.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb-connector-c-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3.4.9-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "mariadb11.8",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "mariadb:10.11/mariadb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "mariadb:10.3/mariadb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "mariadb-connector-c",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb:10.11/mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb:11.8/mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb-connector-c",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "mariadb10.11",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "mariadb11.8",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-12T17:34:04.487Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in MariaDB server. An application processing non-validated user input, which then uses `mysql_real_escape_string()` and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL commands, potentially leading to unauthorized data access or modification within the database."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T12:04:33.662Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-44172"
},
{
"name": "RHBZ#2488459",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68567"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47772"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43505"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30135"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:68567: Red Hat Enterprise Linux AI 3.6 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:47772: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:43505: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:30135: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T18:01:33.248Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-12T17:34:04.487Z",
"value": "Made public."
}
],
"title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "= 3.3.18"
},
{
"status": "affected",
"version": "= 3.4.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:34:04.487Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm"
},
{
"name": "https://jira.mariadb.org/browse/CONC-819",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/CONC-819"
}
],
"source": {
"advisory": "GHSA-pv9p-5w55-55jm",
"discovery": "UNKNOWN"
},
"title": "MariaDB: mysql_real_escape_string() incorrectly handled big5"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44172",
"datePublished": "2026-06-12T17:34:04.487Z",
"dateReserved": "2026-05-05T14:39:34.923Z",
"dateUpdated": "2026-09-17T12:04:33.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44171 (GCVE-0-2026-44171)
Vulnerability from nvd – Published: 2026-06-12 17:33 – Updated: 2026-06-12 18:06
VLAI
EPSS
VEX
Title
MariaDB: path traversal in mbstream
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-12 18:06 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://jira.mariadb.org/browse/MDEV-39408 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44171",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-12T18:06:39.324744Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T18:06:49.446Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.26"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.17"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.11"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.7"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:33:27.365Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-39408",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-39408"
}
],
"source": {
"advisory": "GHSA-9pjh-5hhw-65v9",
"discovery": "UNKNOWN"
},
"title": "MariaDB: path traversal in mbstream"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44171",
"datePublished": "2026-06-12T17:33:27.365Z",
"dateReserved": "2026-05-05T14:39:34.923Z",
"dateUpdated": "2026-06-12T18:06:49.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44170 (GCVE-0-2026-44170)
Vulnerability from nvd – Published: 2026-06-12 17:30 – Updated: 2026-08-03 12:05
VLAI
EPSS
VEX
Title
MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
13 references
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| MariaDB | server |
Affected:
>= 10.6.1, < 10.6.26
Affected: >= 10.11.1, < 10.11.17 Affected: >= 11.4.1, < 11.4.11 Affected: >= 11.8.1, < 11.8.7 Affected: >= 12.3.1, < 12.3.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:10.11.18-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:11.8.8-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
3:10.11.18-1.el10_0 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
8100020260616102001.489197e6 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612104015.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612103452.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
11.8.8-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
10.11.18-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44170",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T03:55:45.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:10.11.18-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb11.8",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:11.8.8-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:10.11.18-1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8100020260616102001.489197e6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:11.8",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612104015.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612103452.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb11-8-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "11.8.8-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb10-11-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "10.11.18-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-12T17:30:15.405Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the server."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:05:48.194Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-44170"
},
{
"name": "RHBZ#2488451",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488451"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44170.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49522"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33093"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33464"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33482"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33481"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25145"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25143"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:49522: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:33093: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33412: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33464: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33482: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33481: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25145: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:25143: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T18:01:03.632Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-12T17:30:15.405Z",
"value": "Made public."
}
],
"title": "mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.26"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.17"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.11"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.7"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:30:15.405Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-f835-cfjq-wf73",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-f835-cfjq-wf73"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-39289",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-39289"
}
],
"source": {
"advisory": "GHSA-f835-cfjq-wf73",
"discovery": "UNKNOWN"
},
"title": "MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44170",
"datePublished": "2026-06-12T17:30:15.405Z",
"dateReserved": "2026-05-05T14:39:34.923Z",
"dateUpdated": "2026-08-03T12:05:48.194Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44169 (GCVE-0-2026-44169)
Vulnerability from nvd – Published: 2026-06-12 17:31 – Updated: 2026-06-13 03:24
VLAI
EPSS
VEX
Title
MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions
Summary
MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-13 03:24 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://jira.mariadb.org/browse/MDEV-39288 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-13T03:24:33.051833Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-13T03:24:46.192Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.11"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.7"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:31:53.344Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-39288",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-39288"
}
],
"source": {
"advisory": "GHSA-22xq-vq3f-87x2",
"discovery": "UNKNOWN"
},
"title": "MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44169",
"datePublished": "2026-06-12T17:31:53.344Z",
"dateReserved": "2026-05-05T14:39:34.923Z",
"dateUpdated": "2026-06-13T03:24:46.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44168 (GCVE-0-2026-44168)
Vulnerability from nvd – Published: 2026-06-12 17:31 – Updated: 2026-08-03 12:06
VLAI
EPSS
VEX
Title
MariaDB: wsrep SST unsafe parameter handling on the donor side
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
13 references
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| MariaDB | server |
Affected:
>= 10.6.1, < 10.6.26
Affected: >= 10.11.1, < 10.11.17 Affected: >= 11.4.1, < 11.4.11 Affected: >= 11.8.1, < 11.8.7 Affected: >= 12.3.1, < 12.3.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:10.11.18-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:11.8.8-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
8100020260616102001.489197e6 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612104015.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612103452.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
11.8.8-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
10.11.18-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T03:55:54.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:10.11.18-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb11.8",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:11.8.8-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8100020260616102001.489197e6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:11.8",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612104015.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612103452.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb11-8-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "11.8.8-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb10-11-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "10.11.18-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-12T17:31:26.921Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in MariaDB. During a State Snapshot Transfer (SST), the donor node improperly validates parameters sent by a joiner node. This vulnerability allows a malicious joiner to execute arbitrary shell commands on the donor server through the mariabackup SST method. This could lead to a complete compromise of the donor system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:06:06.184Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-44168"
},
{
"name": "RHBZ#2488450",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488450"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49522"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33093"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33464"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33482"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33481"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25145"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25143"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:49522: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:33093: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33412: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33464: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33482: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33481: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25145: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:25143: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T18:01:00.657Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-12T17:31:26.921Z",
"value": "Made public."
}
],
"title": "mariadb: Arbitrary Code Execution via improper parameter validation during State Snapshot Transfer",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.26"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.17"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.11"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.7"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:31:26.921Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-39413",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-39413"
}
],
"source": {
"advisory": "GHSA-vwf7-w26c-9w5h",
"discovery": "UNKNOWN"
},
"title": "MariaDB: wsrep SST unsafe parameter handling on the donor side"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44168",
"datePublished": "2026-06-12T17:31:26.921Z",
"dateReserved": "2026-05-05T14:39:34.923Z",
"dateUpdated": "2026-08-03T12:06:06.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107823 (GCVE-0-2026-107823)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:30 – Updated: 2026-10-09 17:30
VLAI
EPSS
VEX
Title
MariaDB: privilege escalation via incorrect view frm parsing
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
7.2 (High)
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/8a642bc8… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40484 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-144",
"description": "CWE-144: Improper Neutralization of Line Delimiters",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:30:36.062Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37"
},
{
"name": "https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40484",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40484"
}
],
"source": {
"advisory": "GHSA-g2q2-3936-cp37",
"discovery": "UNKNOWN"
},
"title": "MariaDB: privilege escalation via incorrect view frm parsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107823",
"datePublished": "2026-10-09T17:30:36.062Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:30:36.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107822 (GCVE-0-2026-107822)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:28 – Updated: 2026-10-09 17:28
VLAI
EPSS
VEX
Title
MariaDB: database privilege escalation via user / role name collision in the acl cache
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
6.4 (Medium)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/67ea07dd… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40541 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB\u0027s ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal\u0027s database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-706",
"description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:28:47.578Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf"
},
{
"name": "https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40541",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40541"
}
],
"source": {
"advisory": "GHSA-2m85-2x26-36rf",
"discovery": "UNKNOWN"
},
"title": "MariaDB: database privilege escalation via user / role name collision in the acl cache"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107822",
"datePublished": "2026-10-09T17:28:47.578Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:28:47.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107821 (GCVE-0-2026-107821)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:27 – Updated: 2026-10-09 17:42
VLAI
EPSS
VEX
Title
MariaDB: insufficient validation of binary frm data when opening a table
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 17:42 UTC
CWE
- CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/3b1c2e58… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40571 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107821",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T17:42:08.587821Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:42:29.482Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1285",
"description": "CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:27:16.316Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5"
},
{
"name": "https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40571",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40571"
}
],
"source": {
"advisory": "GHSA-c4gx-34mg-95q5",
"discovery": "UNKNOWN"
},
"title": "MariaDB: insufficient validation of binary frm data when opening a table"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107821",
"datePublished": "2026-10-09T17:27:16.316Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:42:29.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107819 (GCVE-0-2026-107819)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:25 – Updated: 2026-10-09 17:59
VLAI
EPSS
VEX
Title
MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure
Summary
MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 17:59 UTC
CWE
- CWE-297 - Improper Validation of Certificate with Host Mismatch
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_MISC |
| https://github.com/mariadb-corporation/mariadb-co… | x_refsource_MISC |
| https://jira.mariadb.org/browse/CONC-846 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107819",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T17:59:07.078424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:59:15.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.1, \u003c 3.4.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297: Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:25:45.082Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02"
},
{
"name": "https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10"
},
{
"name": "https://jira.mariadb.org/browse/CONC-846",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/CONC-846"
}
],
"source": {
"advisory": "GHSA-fmq9-qjxj-qpf7",
"discovery": "UNKNOWN"
},
"title": "MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107819",
"datePublished": "2026-10-09T17:25:45.082Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:59:15.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107818 (GCVE-0-2026-107818)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:23 – Updated: 2026-10-09 17:23
VLAI
EPSS
VEX
Title
MariaDB: environment injection via wsrep bootstrap in the mariadb.service file
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
8.4 (High)
CWE
- CWE-15 - External Control of System or Configuration Setting
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/e3d62d4e… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40629 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-15",
"description": "CWE-15: External Control of System or Configuration Setting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:23:58.543Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5"
},
{
"name": "https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40629",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40629"
}
],
"source": {
"advisory": "GHSA-mhvc-vqcq-7vq5",
"discovery": "UNKNOWN"
},
"title": "MariaDB: environment injection via wsrep bootstrap in the mariadb.service file"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107818",
"datePublished": "2026-10-09T17:23:58.543Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:23:58.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107817 (GCVE-0-2026-107817)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:22 – Updated: 2026-10-09 17:22
VLAI
EPSS
VEX
Title
MariaDB: mysql_json plugin OOB reads
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
4.4 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/851f5247… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40678 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:22:19.290Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-89ph-64cf-gqcc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-89ph-64cf-gqcc"
},
{
"name": "https://github.com/MariaDB/server/commit/851f52470d470a96a66e0b7e5599f3b6c2e45907",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/851f52470d470a96a66e0b7e5599f3b6c2e45907"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40678",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40678"
}
],
"source": {
"advisory": "GHSA-89ph-64cf-gqcc",
"discovery": "UNKNOWN"
},
"title": "MariaDB: mysql_json plugin OOB reads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107817",
"datePublished": "2026-10-09T17:22:19.290Z",
"dateReserved": "2026-10-08T21:23:59.823Z",
"dateUpdated": "2026-10-09T17:22:19.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107816 (GCVE-0-2026-107816)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:19 – Updated: 2026-10-09 17:19
VLAI
EPSS
VEX
Title
MariaDB: `qc_info` plugin can do OOB reads if query contains \0
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
6.4 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/09319940… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40670 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:19:00.365Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6"
},
{
"name": "https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40670",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40670"
}
],
"source": {
"advisory": "GHSA-wfqg-88r5-55f6",
"discovery": "UNKNOWN"
},
"title": "MariaDB: `qc_info` plugin can do OOB reads if query contains \\0"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107816",
"datePublished": "2026-10-09T17:19:00.365Z",
"dateReserved": "2026-10-08T21:23:59.822Z",
"dateUpdated": "2026-10-09T17:19:00.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107815 (GCVE-0-2026-107815)
Vulnerability from cvelistv5 – Published: 2026-10-09 16:05 – Updated: 2026-10-09 16:05
VLAI
EPSS
VEX
Title
MariaDB: one byte OOB write in DOS tables of the CONNECT engine
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
8.5 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/b369925f… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://jira.mariadb.org/browse/MDEV-40637 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine\u0027s DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:05:49.046Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq"
},
{
"name": "https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-40637",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-40637"
}
],
"source": {
"advisory": "GHSA-4wgx-ffg9-jrwq",
"discovery": "UNKNOWN"
},
"title": "MariaDB: one byte OOB write in DOS tables of the CONNECT engine"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107815",
"datePublished": "2026-10-09T16:05:49.046Z",
"dateReserved": "2026-10-08T21:23:59.822Z",
"dateUpdated": "2026-10-09T16:05:49.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107814 (GCVE-0-2026-107814)
Vulnerability from cvelistv5 – Published: 2026-10-09 16:02 – Updated: 2026-10-09 16:45
VLAI
EPSS
VEX
Title
MariaDB: Insecure $HOME in MariaDB rpm packages
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 16:16 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://github.com/MariaDB/server/commit/d842d6e9… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
| https://github.com/MariaDB/server/releases/tag/ma… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T16:16:12.667573Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:45:15.295Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.28"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.19"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.13"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.9"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.3"
},
{
"status": "affected",
"version": "\u003e= 13.0.1, \u003c 13.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T16:02:25.544Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"
},
{
"name": "https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"
},
{
"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"
}
],
"source": {
"advisory": "GHSA-m5gf-432r-g5jw",
"discovery": "UNKNOWN"
},
"title": "MariaDB: Insecure $HOME in MariaDB rpm packages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107814",
"datePublished": "2026-10-09T16:02:25.544Z",
"dateReserved": "2026-10-08T21:23:59.822Z",
"dateUpdated": "2026-10-09T16:45:15.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48165 (GCVE-0-2026-48165)
Vulnerability from cvelistv5 – Published: 2026-06-12 17:35 – Updated: 2026-08-03 12:05
VLAI
EPSS
VEX
Title
MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
13 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| MariaDB | server |
Affected:
>= 10.6.1, < 10.6.27
Affected: >= 10.11.1, < 10.11.18 Affected: >= 11.4.1, < 11.4.12 Affected: >= 11.8.1, < 11.8.8 Affected: >= 12.3.1, < 12.3.2 |
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 10) |
cpe:/o:redhat:enterprise_linux:10.2
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux AppStream EUS (v. 10.0) |
cpe:/o:redhat:enterprise_linux_eus:10.0
|
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 8) |
cpe:/a:redhat:enterprise_linux:8::appstream
|
|
| Red Hat | Red Hat Enterprise Linux AppStream (v. 9) |
cpe:/a:redhat:enterprise_linux:9::appstream
|
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48165",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T03:55:56.312Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "galera-0:26.4.27-1.el10_2.aarch64",
"product": "Red Hat Enterprise Linux AppStream (v. 10)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "unaffected",
"packageName": "mariadb-3:10.11.18-1.el10_0.aarch64",
"product": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "unaffected",
"packageName": "Judy-0:1.0.5-18.module+el8.10.0+21221+7bee72c1.aarch64 (mariadb:10.11)",
"product": "Red Hat Enterprise Linux AppStream (v. 8)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "unaffected",
"packageName": "galera-0:26.4.27-1.module+el9.8.0+24388+85f1c439.aarch64 (mariadb:10.11)",
"product": "Red Hat Enterprise Linux AppStream (v. 9)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "mariadb10-11-main@aarch64",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-12T17:35:16.918Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in MariaDB server. A high-privileged MariaDB user could exploit this vulnerability by manipulating specific global system variables, namely wsrep_sst_receive_address or wsrep_sst_donor. This manipulation could allow the user to execute arbitrary shell commands as the user ID of the mariadbd process on a galera joiner node. The primary impact of this flaw is arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:05:49.897Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-48165"
},
{
"name": "RHBZ#2488458",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49522"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33093"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33464"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33482"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33481"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25145"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25143"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:49522: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:33093: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33412: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33464: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33482: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33481: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25145: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:25143: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T18:01:28.777Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-12T17:35:16.918Z",
"value": "Made public."
}
],
"title": "mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.27"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.18"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.12"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.8"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could\u0027ve used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:35:16.918Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-39676",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-39676"
}
],
"source": {
"advisory": "GHSA-7v3p-h23x-8hwv",
"discovery": "UNKNOWN"
},
"title": "MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48165",
"datePublished": "2026-06-12T17:35:16.918Z",
"dateReserved": "2026-05-20T23:12:43.032Z",
"dateUpdated": "2026-08-03T12:05:49.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48163 (GCVE-0-2026-48163)
Vulnerability from cvelistv5 – Published: 2026-06-12 17:34 – Updated: 2026-08-03 12:05
VLAI
EPSS
VEX
Title
MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
13 references
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| MariaDB | server |
Affected:
>= 10.6.1, < 10.6.27
Affected: >= 10.11.1, < 10.11.18 Affected: >= 11.4.1, < 11.4.12 Affected: >= 11.8.1, < 11.8.8 Affected: >= 12.3.1, < 12.3.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:10.11.18-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:11.8.8-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
3:10.11.18-1.el10_0 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
8100020260616102001.489197e6 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612104015.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612103452.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
11.8.8-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
10.11.18-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48163",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T03:55:55.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:10.11.18-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb11.8",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:11.8.8-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:10.11.18-1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8100020260616102001.489197e6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:11.8",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612104015.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612103452.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb11-8-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "11.8.8-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb10-11-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "10.11.18-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-12T17:34:57.923Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in MariaDB server. During the State Snapshot Transfer (SST) process, a malicious joiner node could exploit improper parameter validation on the donor node. This vulnerability, specifically within the rsync SST method, allows the malicious joiner to execute arbitrary shell commands on the donor server, leading to potential compromise of the system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:05:46.876Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-48163"
},
{
"name": "RHBZ#2488454",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49522"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33093"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33464"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33482"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33481"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25145"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25143"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:49522: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:33093: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33412: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33464: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33482: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33481: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25145: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:25143: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T18:01:12.767Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-12T17:34:57.923Z",
"value": "Made public."
}
],
"title": "mariadb: Arbitrary code execution via improper parameter validation during SST",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.27"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.18"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.12"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.8"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:34:57.923Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-39648",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-39648"
}
],
"source": {
"advisory": "GHSA-rpgv-q6gv-684r",
"discovery": "UNKNOWN"
},
"title": "MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48163",
"datePublished": "2026-06-12T17:34:57.923Z",
"dateReserved": "2026-05-20T23:12:43.032Z",
"dateUpdated": "2026-08-03T12:05:46.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44173 (GCVE-0-2026-44173)
Vulnerability from cvelistv5 – Published: 2026-06-12 17:34 – Updated: 2026-08-03 12:06
VLAI
EPSS
VEX
Title
MariaDB: FILE privilege was not checked for subqueries in the FROM clause
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Severity
5 (Medium)
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-12 18:03 UTC
Assigner
References
13 references
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| MariaDB | server |
Affected:
>= 10.6.1, < 10.6.26
Affected: >= 10.11.1, < 10.11.17 Affected: >= 11.4.1, < 11.4.11 Affected: >= 11.8.1, < 11.8.7 Affected: >= 12.3.1, < 12.3.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:10.11.18-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
3:11.8.8-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
8100020260616102001.489197e6 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612104015.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
9080020260612103452.rhel9 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
11.8.8-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
10.11.18-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-12T18:03:24.496133Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T18:03:34.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:10.11.18-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb11.8",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3:11.8.8-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8100020260616102001.489197e6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:11.8",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612104015.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "mariadb:10.11",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "9080020260612103452.rhel9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb11-8-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "11.8.8-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb10-11-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "10.11.18-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-12T17:34:30.301Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in MariaDB server. This vulnerability allows a low-privileged authenticated user to bypass a security control that normally restricts file operations. Specifically, the system failed to verify the necessary \u0027FILE\u0027 privilege when certain \u0027SELECT\u0027 statements, which write data to files, were executed with subqueries in their \u0027FROM\u0027 clause. This could enable an attacker to write unauthorized files to the server\u0027s file system, potentially leading to the disclosure of sensitive information or a denial of service by corrupting or filling disk space."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:06:06.566Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-44173"
},
{
"name": "RHBZ#2488460",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488460"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49522"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33093"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33412"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33464"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33482"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33481"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25145"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25143"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:49522: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:33093: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33412: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:33464: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33482: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33481: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25145: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:25143: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T18:01:36.157Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-12T17:34:30.301Z",
"value": "Made public."
}
],
"title": "mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.6.1, \u003c 10.6.26"
},
{
"status": "affected",
"version": "\u003e= 10.11.1, \u003c 10.11.17"
},
{
"status": "affected",
"version": "\u003e= 11.4.1, \u003c 11.4.11"
},
{
"status": "affected",
"version": "\u003e= 11.8.1, \u003c 11.8.7"
},
{
"status": "affected",
"version": "\u003e= 12.3.1, \u003c 12.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:34:30.301Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc"
},
{
"name": "https://jira.mariadb.org/browse/MDEV-39493",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/MDEV-39493"
}
],
"source": {
"advisory": "GHSA-667j-m53j-wpmc",
"discovery": "UNKNOWN"
},
"title": "MariaDB: FILE privilege was not checked for subqueries in the FROM clause"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44173",
"datePublished": "2026-06-12T17:34:30.301Z",
"dateReserved": "2026-05-05T14:39:34.923Z",
"dateUpdated": "2026-08-03T12:06:06.566Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44172 (GCVE-0-2026-44172)
Vulnerability from cvelistv5 – Published: 2026-06-12 17:34 – Updated: 2026-09-17 12:04
VLAI
EPSS
VEX
Title
MariaDB: mysql_real_escape_string() incorrectly handled big5
Summary
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-12 20:02 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/MariaDB/server/security/adviso… | x_refsource_CONFIRM |
| https://jira.mariadb.org/browse/CONC-819 | x_refsource_MISC |
| https://access.redhat.com/security/cve/CVE-2026-44172 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2488459 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
| https://access.redhat.com/errata/RHSA-2026:68567 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:47772 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:43505 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:30135 | vendor-advisoryx_refsource_REDHAT |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| MariaDB | server |
Affected:
= 3.3.18
Affected: = 3.4.8 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:3.4.4-2.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:3.4.4-1.el10_0.1 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
3.4.9-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-12T20:02:02.774991Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T20:02:12.617Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "mariadb-connector-c",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.4.4-2.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "mariadb-connector-c",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.4.4-1.el10_0.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb-connector-c-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3.4.9-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "mariadb10.11",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "mariadb11.8",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "mariadb:10.11/mariadb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "mariadb:10.3/mariadb",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "mariadb-connector-c",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb:10.11/mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb:11.8/mariadb",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "mariadb-connector-c",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "mariadb10.11",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "mariadb11.8",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-12T17:34:04.487Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in MariaDB server. An application processing non-validated user input, which then uses `mysql_real_escape_string()` and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL commands, potentially leading to unauthorized data access or modification within the database."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T12:04:33.662Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-44172"
},
{
"name": "RHBZ#2488459",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68567"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47772"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43505"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30135"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:68567: Red Hat Enterprise Linux AI 3.6 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:47772: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:43505: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:30135: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-12T18:01:33.248Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-12T17:34:04.487Z",
"value": "Made public."
}
],
"title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "MariaDB",
"versions": [
{
"status": "affected",
"version": "= 3.3.18"
},
{
"status": "affected",
"version": "= 3.4.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T17:34:04.487Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm"
},
{
"name": "https://jira.mariadb.org/browse/CONC-819",
"tags": [
"x_refsource_MISC"
],
"url": "https://jira.mariadb.org/browse/CONC-819"
}
],
"source": {
"advisory": "GHSA-pv9p-5w55-55jm",
"discovery": "UNKNOWN"
},
"title": "MariaDB: mysql_real_escape_string() incorrectly handled big5"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44172",
"datePublished": "2026-06-12T17:34:04.487Z",
"dateReserved": "2026-05-05T14:39:34.923Z",
"dateUpdated": "2026-09-17T12:04:33.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}