MariaDB names five server flaws fixed in its August and September builds

MariaDB names five server flaws fixed in its August and September builds

9 October 2026: MariaDB has published five high severity CVEs in MariaDB Server, the most serious of which, CVE-2026-107815 (CVSS 8.5), lets an authenticated user of the CONNECT storage engine crash the server and possibly run code on it. Every supported branch from 10.6 to 13.0 is affected, and the fixes are in releases that shipped between 13 August and 15 September.

The fixes came first and the CVE numbers later. MariaDB's advisories on GitHub went up on 7 and 21 September, the CVE records were published on 9 October, and Belgium's national cyber centre issued a "patch immediately" warning on 13 October. A server updated in the last two months is already covered; one that has not been touched since July is not.

Fixed versions by branch

• 10.6: fixed in 10.6.28 (released 13 August)
• 10.11: fixed in 10.11.19 (24 August)
• 11.4: fixed in 11.4.13 (24 August)
• 11.8: fixed in 11.8.9 (24 August)
• 12.3: fixed in 12.3.3 (24 August)
• 13.0: fixed in 13.0.2 (15 September)

Four of the five need a powerful privilege

Only the CONNECT engine flaw can be reached by an ordinary authenticated user, and only on a server where the CONNECT plugin is installed. Its DOS table type used a wrong boundary check that allowed a one-byte write past a stack buffer at an offset the attacker controls. MariaDB's workaround is simply not to have the CONNECT plugin installed unless it is needed.

The other four sit behind privileges that most installations hand out sparingly:

• CVE-2026-107814 (8.4): MariaDB's RPM packages gave the mysql service account the data directory as its home, so a user with the FILE privilege could plant a .bash_profile that runs when an administrator opens a login shell as mysql. Debian packages are not affected. The workaround is to point the account's home somewhere the server cannot write.
• CVE-2026-107818 (8.4): with FILE and a secure-file-priv setting that allows writes to /run/mysqld, a user could create the wsrep bootstrap file and inject environment values into the next service restart.
• CVE-2026-107821 (8.0): a crafted FRM table file placed in the data directory could trigger out-of-bounds reads or writes when the table is opened.
• CVE-2026-107823 (7.2): an account holding CREATE USER and CREATE VIEW WITH GRANT OPTION could hide view security metadata inside a username containing newlines and escalate its own database privileges.

Where the risk is real

The privilege-gated flaws matter most where database accounts are handed to people who are not fully trusted: shared hosting panels, platforms that give each customer a database, and applications that were granted FILE for an import job years ago. The CVE-2026-107818 report came through the security team of a hosting-panel vendor, and the view parser flaw was reported by a WordPress hosting company's security team. On those systems, revoking FILE from every account that does not need it and checking secure-file-priv is worth doing even after the upgrade.

MariaDB in our catalogue

MariaDB is one of 35 products in our RDBMS software category, alongside MySQL, Percona Server for MySQL and PostgreSQL. None of the five advisories says the flaws are shared with MySQL.

Sources

• MariaDB on GitHub: security advisory GHSA-4wgx-ffg9-jrwq (CVE-2026-107815, CONNECT engine), 7 September 2026
• MariaDB on GitHub: security advisory GHSA-m5gf-432r-g5jw (CVE-2026-107814, RPM package home directory), 21 September 2026
• CVE record CVE-2026-107815 (published by the CVE programme), 9 October 2026
• Centre for Cybersecurity Belgium: multiple high severity vulnerabilities in MariaDB Server, 13 October 2026