MariaDB Server Audit Plugin Comment Handling Bypass
Priority LOW 24CWE-778Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix Partial MariaDB Server (MariaDB Foundation): 10.6.25, 10.11.16, 11.4.10 +1Aurora MySQL (Amazon): 2.12.6, 3.04.6, 3.10.3 +1+2 more productsRed Hat: 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MariaDB Foundation | MariaDB Server | before 10.6.25; before 10.11.16; before 11.4.10; before 11.8.6 | 10.6.25, 10.11.16, 11.4.10, 11.8.6 | Patch available | CNA |
| AWS | Aurora MySQL | before 2.12.6; before 3.04.6; before 3.10.3; before 3.11.1 | 2.12.6, 3.04.6, 3.10.3, 3.11.1 | Patch available | CNA |
| AWS | RDS for MySQL | before 5.7.44-RDS.20260212; before 8.0.45; before 8.4.8 | 5.7.44-RDS.20260212, 8.0.45, 8.4.8 | Patch available | CNA |
| AWS | RDS for MariaDB | before 10.6.25; before 10.11.16; before 11.4.10; before 11.8.6 | 10.6.25, 10.11.16, 11.4.10, 11.8.6 | Patch available | CNA |
- MariaDB Server VendorMariaDB Foundation Affected before 10.6.25; before 10.11.16; before 11.4.10; before 11.8.6 Fixed in 10.6.25, 10.11.16, 11.4.10, 11.8.6 Patch available CNA
- Aurora MySQL VendorAWS Affected before 2.12.6; before 3.04.6; before 3.10.3; before 3.11.1 Fixed in 2.12.6, 3.04.6, 3.10.3, 3.11.1 Patch available CNA
- RDS for MySQL VendorAWS Affected before 5.7.44-RDS.20260212; before 8.0.45; before 8.4.8 Fixed in 5.7.44-RDS.20260212, 8.0.45, 8.4.8 Patch available CNA
- RDS for MariaDB VendorAWS Affected before 10.6.25; before 10.11.16; before 11.4.10; before 11.8.6 Fixed in 10.6.25, 10.11.16, 11.4.10, 11.8.6 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* | up to 10.6.24; 10.7.0 – 10.11.15; 11.0.0 – 11.4.9; 11.5.0 – 11.8.5 | Vulnerable | MariaDB |
| cpe:2.3:a:amazon:aurora_mysql:*:*:*:*:*:*:*:* | up to 2.12.5; 3.01.0 to before 3.04.6; 3.05.1 – 3.10.2 | Vulnerable | AWS |
| cpe:2.3:a:amazon:aurora_mysql:3.11.0:*:*:*:*:*:*:* | 3.11.0 | Vulnerable | AWS |
| cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mysql:*:* | up to 5.7.44-rds.20251212 | Vulnerable | AWS |
| cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:* | up to 10.6.24 | Vulnerable | AWS |
| cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mysql:*:* | 8.0.11 – 8.0.44; 8.4.3 – 8.4.7 | Vulnerable | AWS |
| cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:* | 10.11.4 – 10.11.15; 11.4.3 – 11.4.9; 11.8.3 – 11.8.5 | Vulnerable | AWS |
- cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* Versions up to 10.6.24; 10.7.0 – 10.11.15; 11.0.0 – 11.4.9; 11.5.0 – 11.8.5 Vulnerable ·MariaDB
- cpe:2.3:a:amazon:aurora_mysql:*:*:*:*:*:*:*:* Versions up to 2.12.5; 3.01.0 to before 3.04.6; 3.05.1 – 3.10.2 Vulnerable ·AWS
- cpe:2.3:a:amazon:aurora_mysql:3.11.0:*:*:*:*:*:*:* Versions 3.11.0 Vulnerable ·AWS
- cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mysql:*:* Versions up to 5.7.44-rds.20251212 Vulnerable ·AWS
- cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:* Versions up to 10.6.24 Vulnerable ·AWS
- cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mysql:*:* Versions 8.0.11 – 8.0.44; 8.4.3 – 8.4.7 Vulnerable ·AWS
- cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:* Versions 10.11.4 – 10.11.15; 11.4.3 – 11.4.9; 11.8.3 – 11.8.5 Vulnerable ·AWS
Remediation
- Fix · CNA MariaDB Server (MariaDB Foundation) Fixed in 10.6.25, 10.11.16, 11.4.10, 11.8.6
- Fix · CNA Aurora MySQL (Amazon) Fixed in 2.12.6, 3.04.6, 3.10.3, 3.11.1
- Fix · CNA RDS for MySQL (Amazon) Fixed in 5.7.44-RDS.20260212, 8.0.45, 8.4.8
- Fix · CNA RDS for MariaDB (Amazon) Fixed in 10.6.25, 10.11.16, 11.4.10, 11.8.6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3494
- 2026-10-03 Alias added: GHSA-qmjm-438j-w485
- 2026-10-20 Affected versions changed · CNA
References
Sources
- CVE-2026-3494 · CVE Program
- CVE-2026-3494 · NVD
- FIRST EPSS
- GHSA-qmjm-438j-w485 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-3494 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences