MEDIUM🇵🇱 Wersja polska

CVE-2026-3494

CVSS 5.3v4.0pub. 2026-03-03upd. 2026-03-16

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Amazon Aurora MySQL

    APP
    Amazon
    3.11.0≤ 2.12.53.05.1 – 3.10.23.01.0 – 3.04.5

  • Amazon Relational Database Service

    APP
    Amazon
    11.8.3 – 11.8.58.0.11 – 8.0.448.4.3 – 8.4.710.11.4 – 10.11.1511.4.3 – 11.4.9≤ 5.7.44-rds.20251212≤ 10.6.24

  • MariaDB

    APP
    Mariadb
    11.5.0 – 11.8.511.0.0 – 11.4.910.7.0 – 10.11.15≤ 10.6.24
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-49261CRITICAL10.0PL ✓same product

MariaDB: command injection przez wsrep_notify_cmd w nazwie węzła Galera

CVE-2023-26785CRITICAL9.8PL ✓same product

MariaDB v10.5 — RCE przez UDF w plikach współdzielonych (disputed)

CVE-2020-15180CRITICAL9.0PL ✓same product

Command injection w MariaDB mysql-wsrep via wsrep_sst_method

CVE-2016-9843CRITICAL9.8PL ✓same product

Błąd w funkcji crc32_big w zlib 1.2.8 — nieokreślony wpływ na system

CVE-2016-6662CRITICAL9.8PL ✓same product

RCE z uprawnieniami root w Oracle MySQL, MariaDB i Percona Server