MARIADB has disclosed a set of nine vulnerabilities affecting both the MariaDB Server and the Connector/C client library, disclosed on 9 October 2026 and publicised on 12 October 2026. Five of the flaws are rated high severity, with CVSSv3 scores up to 8.5, and the issues range from potential code execution and host takeover to privilege escalation and data leaks. Notably, none of the listed vulnerabilities are confirmed as exploited in the wild at the time of the advisory, and no public PoCs have been confirmed.
The vulnerabilities span multiple components and versions. On the server side, issues include a stack buffer bug in the CONNECT engine (CVE-2026-107815, CVSS 8.5) that could enable authenticated users to crash the server or run code, and a FILE-privilege abuse (CVE-2026-107818, CVSS 8.4) that could inject environment values on next restart.
Additional problems involve incorrect home directory placement for the mysql account in RPM packages (CVE-2026-107814, CVSS 8.4) and weak FRM file validation (CVE-2026-107821, CVSS 8.0). Privilege escalation routes include crafted usernames inserting metadata into views (CVE-2026-107823, CVSS 7.2) and colliding account names borrowing cached privileges (CVE-2026-107822, CVSS 6.4).
Data leakage and password theft risks involve memory leaks and an TLS hostname check bypass in Connector/C (CVE-2026-107816, CVSS 6.4; CVE-2026-107819, CVSS 5.9).
Affected are MariaDB Server 10.6.1 and later, up to certain older branches before 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2, and MariaDB Connector/C 3.4.1 through 3.4.9. Patches are available: upgrade Server to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 or 13.0.2, and Connector/C to 3.4.10. Mitigations also include restricting FILE, CREATE USER and GRANT privileges to trusted admins and, if unused, disabling the CONNECT engine. Full details are in the MariaDB server security advisories.