MariaDB Patches Nine Vulnerabilities Enabling Privilege Escalation and Code Execution

TL;DR

MariaDB disclosed nine vulnerabilities on October 9, 2026, covering its database server and the Connector/C client library. Five of the MariaDB vulnerabilities rate high, with CVSS scores up to 8.5. The worst could let authenticated users escalate privileges or run code on the server.

Notable CVEs

Why It Matters

MariaDB powers countless web apps and enterprise systems. Most of these flaws need an existing database account. However, a low-level account or a stolen credential can still become a path to full server control.

How the Attacks Work

Code execution and host takeover

• CVE-2026-107815 (CVSS 8.5): a stack buffer bug in the CONNECT engine. Authenticated users could crash the server and potentially run code.
• CVE-2026-107818 (CVSS 8.4): a user with the FILE privilege could inject environment values into the service on its next restart.
• CVE-2026-107814 (CVSS 8.4): RPM packages placed the mysql account’s home in the data directory. Startup files could then run when an admin opened a login shell. Debian packages are not affected.
• CVE-2026-107821 (CVSS 8.0): weak validation of FRM table files could allow memory corruption.

Privilege escalation

Two bugs target MariaDB’s permission system. CVE-2026-107823 (CVSS 7.2) lets a crafted username slip extra metadata into a view. Similarly, CVE-2026-107822 (CVSS 6.4) lets a colliding account name borrow another account’s cached privileges.

Data leaks and password theft

CVE-2026-107816 and CVE-2026-107817 can leak memory or crash the server. Meanwhile, CVE-2026-107819 in Connector/C skipped a TLS hostname check. As a result, a man-in-the-middle attacker could capture database passwords.

Exploitation status

No exploitation in the wild has been confirmed. Likewise, no public proof-of-concept has been confirmed for these MariaDB vulnerabilities.

Affected Versions

• MariaDB Server 10.6.1 and later, before 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
• MariaDB Connector/C 3.4.1 through 3.4.9.

Patch and Mitigation Steps

• Upgrade MariaDB Server to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 or 13.0.2.
• Update Connector/C to version 3.4.10.
• Limit the FILE, CREATE USER and GRANT privileges to trusted administrators.
• Disable the CONNECT engine if you do not use it.

Full details sit in the MariaDB server security advisories on GitHub.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.