mariadb

Server part of MariaDB

Current: 11.8.6
Candidate: 13.0.2Stale

License: GPL-2.0-only

Build

Target	Result	Last successful version	Succeeded at
rva23	Succeeded	11.8.6	2026-10-09 20:48:31 UTC
rva20	Succeeded	11.8.6	2026-10-09 15:18:16 UTC
x86_64	Succeeded	11.8.6	2026-10-09 09:03:31 UTC

Advisory · 22

Query product: mariadbNVD
Query vendor: mariadbNVD
Query version: 11.8.6NVD

Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.

CVE-2026-107814
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13,…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.489%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 13.0.1, < 13.0.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HNVD
Summary characters omitted
28NVD
References
Advisory · github.com Fix · d842d6e994a8 Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com
CVE-2026-107815
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
1.38%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 13.0.1, < 13.0.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HNVD
References
Advisory · github.com Fix · b369925f6855 Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-107816
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.345%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 13.0.1, < 13.0.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:LNVD
References
Advisory · github.com Fix · 0931994096b8 Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-107817
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.151%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 13.0.1, < 13.0.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:LNVD
References
Advisory · github.com Fix · 851f52470d47 Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-107818
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.401%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 13.0.1, < 13.0.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HNVD
References
Advisory · github.com Fix · e3d62d4e78fd Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-107821
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
1.2%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 13.0.1, < 13.0.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HNVD
References
Advisory · github.com Fix · 3b1c2e58abab Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-107822
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.516%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 13.0.1, < 13.0.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:HNVD
References
Advisory · github.com Fix · 67ea07dd3400 Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-107823
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.786%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 13.0.1, < 13.0.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVD
References
Advisory · github.com Fix · 8a642bc8103a Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-44168
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.588%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.17, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.26, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.11, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.7, cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HNVD
Additional references
1NVD
References
Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · bugzilla.redhat.com Web · github.com Web · jira.mariadb.org
CVE-2026-44169
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.237%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.11, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.7, cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NNVD
References
Advisory · github.com Web · jira.mariadb.org
CVE-2026-44170
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
1.33%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.17, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.26, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.11, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.7, cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
CVSS_V4
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
Additional references
1NVD
References
Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · bugzilla.redhat.com Web · github.com Web · jira.mariadb.org
CVE-2026-44171
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.188%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.17, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.26, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.11, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.7, cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD
References
Advisory · github.com Web · jira.mariadb.org
CVE-2026-44173
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.62%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.17, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.26, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.11, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.7, cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:LNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NNVD
Additional references
1NVD
References
Advisory · github.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · bugzilla.redhat.com Web · jira.mariadb.org
CVE-2026-48163
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.914%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.18, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.27, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.12, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.8, cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVD
Additional references
1NVD
References
Advisory · github.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · bugzilla.redhat.com Web · jira.mariadb.org
CVE-2026-48165
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
1.51%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.18, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.27, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.12, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.8, cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVD
Additional references
1NVD
References
Advisory · github.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · bugzilla.redhat.com Web · jira.mariadb.org
CVE-2026-49261
NVD
Summary
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
1.58%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.18, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.27, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.12, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.8, cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
Additional references
3NVD
References
Advisory · github.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com
CVE-2026-85745
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.534%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NNVD
References
Advisory · github.com Fix · 2bf355e361db Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-85746
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.97%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HNVD
Summary characters omitted
2NVD
References
Advisory · github.com Fix · 5c04ca552438 Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-85985
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subjec…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.452%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NNVD
Summary characters omitted
122NVD
References
Advisory · github.com Fix · 4f66ca1b69da Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-86047
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned ou…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.856%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:HNVD
Additional references
5NVD
Summary characters omitted
104NVD
References
Advisory · github.com Fix · 2b28d1c42410 Fix · 364656922575 Fix · 5acb43522863 Fix · 9d4ffe23b258 Fix · d5d741a3076f Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com
CVE-2026-92262
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
1.45%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HNVD
References
Advisory · github.com Fix · 574ba66b2d6c Fix · f277eefa4248 Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org
CVE-2026-97380
NVD
Summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
1.3%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.11.1, < 10.11.19, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 10.6.1, < 10.6.28, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.4.1, < 11.4.13, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 11.8.1, < 11.8.9, cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*; >= 12.3.1, < 12.3.3, cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
References
Advisory · github.com Fix · dbd60d0ad8da Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · github.com Web · jira.mariadb.org

Description

MariaDB is an open-source, multi-threaded, relational database management system. It's a backward compatible, drop-in replacement branch of the MySQL Community Server. This package only contains the server-side programs.

Changelog

SPECS: mariadb: create mysql sysusers before unpack
Jingwiwef09b6a5702e2026-03-31 19:24:36 UTC
SPECS: mariadb: fix startup failure due to missing /run/mysql directory
Sun Yuechi0f5159c025292026-03-21 11:13:19 UTC
SPECS: mariadb: Upgrade to 11.8.6.
laokzad26e45b01772026-03-20 05:34:02 UTC
SPECS: mariadb: Fix spec file formatting.
misaka002517afb9cd905232026-01-27 07:23:13 UTC
SPECS: Add mariadb.
Sun Yuechi707efcc193c12025-12-04 15:55:54 UTC

PR · 3

#590 SPECS: add python-mysql-connector-python
KimmyXYC2026-06-04 07:03:40 UTC
#104 SPECS: *: Fix style %{?autochangelog} -> %autochangelog (automated)
dramforever2026-04-09 06:15:39 UTC
#27 fix sysusers: clean up bootstrap flow and provider ownership
Jingwiw2026-04-01 13:24:19 UTC

Checks

Monitor	Observation	Last checked
Source	Stale Repository refresh: git fetch exited 128 (authentication)	2026-11-10 19:28:57 UTC
Version	Stale Source last confirmed at 2026-11-10T19:28:57+00:00; repository refresh overdue.	2026-11-10 17:37:16 UTC
Build	Checked	2026-11-10 20:40:28 UTC
GitHub	Checked	2026-11-10 20:38:13 UTC
EOL	Checked Current source cycle 11.8; upstream lifecycle only.	2026-11-10 18:08:02 UTC
LicenseDiff	Not configured No reliable monitor identity/configuration.	—
Dependencies	Not configured No reliable monitor identity/configuration.	—
Advisory	Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated.	2026-11-10 18:53:26 UTC Last attempted2026-11-10 18:55:33 UTC
Yanked	Not configured No reliable monitor identity/configuration.	—

Monitor	Checks
Source	6367 Stale 17 CheckFailed
Version	5459 Stale 210 CheckFailed 707 Not configured 8 Input unavailable
Build	6382 Checked 2 Not yet checked
GitHub	6384 Checked
EOL	6260 Not configured 118 Checked 3 Metadata unavailable 3 Input unavailable
LicenseDiff	1665 Not configured 187 Input changed 3168 Not applicable 12 Input unavailable 1139 Checked 209 Metadata unavailable 4 CheckFailed
Dependencies	1852 Not configured 3214 Checked 1248 Metadata unavailable 7 Input unavailable 58 Partial evidence 5 CheckFailed
Advisory	4996 Checked 1375 Not configured 7 Input unavailable 6 Metadata unavailable
Yanked	2248 Not configured 4116 Checked 5 CheckFailed 7 Input unavailable 8 Metadata unavailable