Vulnerability-Lookup

CVE-2026-3494 (GCVE-0-2026-3494)

Vulnerability from cvelistv5 – Published: 2026-03-03 18:12 – Updated: 2026-03-16 17:03

Title

MariaDB Server Audit Plugin Comment Handling Bypass

Summary

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-03 18:56 UTC

CWE

CWE-778 - (Insufficient Logging)

Assigner

AMZN mitre root

References

3 references

URL	Tags
https://aws.amazon.com/security/security-bulletin…	vendor-advisory
https://github.com/MariaDB/server/commit/635559a2…	patch
https://github.com/aws/audit-plugin-for-mysql/com…	patch

Impacted products

4 products

Vendor	Product	Version	CPE status
MariaDB Foundation	MariaDB Server	Unaffected: 10.6.25 Unaffected: 10.11.16 Unaffected: 11.4.10 Unaffected: 11.8.6	guessed
Amazon	Aurora MySQL	Unaffected: 2.12.6 Unaffected: 3.04.6 Unaffected: 3.10.3 Unaffected: 3.11.1	guessed
Amazon	RDS for MySQL	Unaffected: 5.7.44-RDS.20260212 Unaffected: 8.0.45 Unaffected: 8.4.8	guessed
Amazon	RDS for MariaDB	Unaffected: 10.6.25 Unaffected: 10.11.16 Unaffected: 11.4.10 Unaffected: 11.8.6	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3494",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-03T18:56:25.959459Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-03T18:56:35.946Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MariaDB Server",
          "vendor": "MariaDB Foundation",
          "versions": [
            {
              "status": "unaffected",
              "version": "10.6.25"
            },
            {
              "status": "unaffected",
              "version": "10.11.16"
            },
            {
              "status": "unaffected",
              "version": "11.4.10"
            },
            {
              "status": "unaffected",
              "version": "11.8.6"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Aurora MySQL",
          "vendor": "Amazon",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.12.6"
            },
            {
              "status": "unaffected",
              "version": "3.04.6"
            },
            {
              "status": "unaffected",
              "version": "3.10.3"
            },
            {
              "status": "unaffected",
              "version": "3.11.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "RDS for MySQL",
          "vendor": "Amazon",
          "versions": [
            {
              "status": "unaffected",
              "version": "5.7.44-RDS.20260212"
            },
            {
              "status": "unaffected",
              "version": "8.0.45"
            },
            {
              "status": "unaffected",
              "version": "8.4.8"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "RDS for MariaDB",
          "vendor": "Amazon",
          "versions": [
            {
              "status": "unaffected",
              "version": "10.6.25"
            },
            {
              "status": "unaffected",
              "version": "10.11.16"
            },
            {
              "status": "unaffected",
              "version": "11.4.10"
            },
            {
              "status": "unaffected",
              "version": "11.8.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (\u2014) or hash (#) style comments, the statement is not logged.\u003c/p\u003e"
            }
          ],
          "value": "In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (\u2014) or hash (#) style comments, the statement is not logged."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-93",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-93 (Log Injection-Tampering-Forging)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-778",
              "description": "CWE-778 (Insufficient Logging)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-16T17:03:08.613Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/2026-006-AWS/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MariaDB Server Audit Plugin Comment Handling Bypass",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2026-3494",
    "datePublished": "2026-03-03T18:12:12.361Z",
    "dateReserved": "2026-03-03T17:26:55.939Z",
    "dateUpdated": "2026-03-16T17:03:08.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-3494",
      "date": "2026-09-16",
      "epss": "0.00274",
      "percentile": "0.19855"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-14T01:37:11.000Z",
      "cve": "CVE-2026-3494",
      "id": "msrc_CVE-2026-3494",
      "initial_release_date": "2026-03-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "MariaDB Server Audit Plugin Comment Handling Bypass",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-3494.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-3494\",\"sourceIdentifier\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"published\":\"2026-03-03T20:16:50.667\",\"lastModified\":\"2026-07-14T15:43:43.080\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (\u2014) or hash (#) style comments, the statement is not logged.\"},{\"lang\":\"es\",\"value\":\"En la versi\u00f3n del servidor MariaDB hasta la 11.8.5, cuando el plugin de auditor\u00eda del servidor est\u00e1 habilitado con la variable server_audit_events configurada con el filtrado QUERY_DCL, QUERY_DDL o QUERY_DML, si un usuario de base de datos autenticado invoca una instrucci\u00f3n SQL prefijada con comentarios estilo doble guion (\u2014) o almohadilla (#), la instrucci\u00f3n no se registra.\"}],\"affected\":[{\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"affectedData\":[{\"vendor\":\"MariaDB Foundation\",\"product\":\"MariaDB Server\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"10.6.25\",\"status\":\"unaffected\"},{\"version\":\"10.11.16\",\"status\":\"unaffected\"},{\"version\":\"11.4.10\",\"status\":\"unaffected\"},{\"version\":\"11.8.6\",\"status\":\"unaffected\"}]},{\"vendor\":\"Amazon\",\"product\":\"Aurora MySQL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"2.12.6\",\"status\":\"unaffected\"},{\"version\":\"3.04.6\",\"status\":\"unaffected\"},{\"version\":\"3.10.3\",\"status\":\"unaffected\"},{\"version\":\"3.11.1\",\"status\":\"unaffected\"}]},{\"vendor\":\"Amazon\",\"product\":\"RDS for MySQL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"5.7.44-RDS.20260212\",\"status\":\"unaffected\"},{\"version\":\"8.0.45\",\"status\":\"unaffected\"},{\"version\":\"8.4.8\",\"status\":\"unaffected\"}]},{\"vendor\":\"Amazon\",\"product\":\"RDS for MariaDB\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"10.6.25\",\"status\":\"unaffected\"},{\"version\":\"10.11.16\",\"status\":\"unaffected\"},{\"version\":\"11.4.10\",\"status\":\"unaffected\"},{\"version\":\"11.8.6\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-03T18:56:25.959459Z\",\"id\":\"CVE-2026-3494\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-778\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"10.6.24\",\"matchCriteriaId\":\"8A30EA78-32F5-4C1B-A67A-23DC6C7B72EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.7.0\",\"versionEndIncluding\":\"10.11.15\",\"matchCriteriaId\":\"332B395C-4839-4615-B00B-E4D441F2CD0A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndIncluding\":\"11.4.9\",\"matchCriteriaId\":\"A26387F9-8443-4057-A5E1-441377F32CDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.5.0\",\"versionEndIncluding\":\"11.8.5\",\"matchCriteriaId\":\"A2088E08-6CAF-4EA5-BF0D-1E5F7D895EAE\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:aurora_mysql:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.12.5\",\"matchCriteriaId\":\"47D5C055-479D-48B1-9A1B-96A03A991BF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:aurora_mysql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.01.0\",\"versionEndExcluding\":\"3.04.6\",\"matchCriteriaId\":\"1D6AC3BC-CEF0-4D92-9FA6-7BC11C0F59D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:aurora_mysql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.05.1\",\"versionEndIncluding\":\"3.10.2\",\"matchCriteriaId\":\"71F2AFB8-E9B5-41BB-9FA6-5FD6DF742609\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:aurora_mysql:3.11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6548276-890D-4BAA-B63C-2589276CB05B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mysql:*:*\",\"versionEndIncluding\":\"5.7.44-rds.20251212\",\"matchCriteriaId\":\"19020403-62DD-4582-94FC-C942145BE41C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:*\",\"versionEndIncluding\":\"10.6.24\",\"matchCriteriaId\":\"D726E50A-7EF5-416D-A87A-2BF960AD2FE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mysql:*:*\",\"versionStartIncluding\":\"8.0.11\",\"versionEndIncluding\":\"8.0.44\",\"matchCriteriaId\":\"D0E5AB60-5EAB-4425-A5ED-D7A4C885412B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mysql:*:*\",\"versionStartIncluding\":\"8.4.3\",\"versionEndIncluding\":\"8.4.7\",\"matchCriteriaId\":\"245D28E5-72B2-425D-B45A-A8FF86253512\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:*\",\"versionStartIncluding\":\"10.11.4\",\"versionEndIncluding\":\"10.11.15\",\"matchCriteriaId\":\"231A1730-3772-4CBD-9987-88261193DE56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:*\",\"versionStartIncluding\":\"11.4.3\",\"versionEndIncluding\":\"11.4.9\",\"matchCriteriaId\":\"BAFD31F7-359F-4CC7-8DDF-4543EB8478D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:*\",\"versionStartIncluding\":\"11.8.3\",\"versionEndIncluding\":\"11.8.5\",\"matchCriteriaId\":\"06BB3DE6-41A1-4D83-B3ED-E3200E8A414B\"}]}]}],\"references\":[{\"url\":\"https://aws.amazon.com/security/security-bulletins/2026-006-AWS/\",\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261\",\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff\",\"source\":\"ff89ba41-3aa1-4d27-914a-91399e9639e5\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:15:27+00:00",
      "cve": "CVE-2026-3494",
      "id": "CVE-2026-3494",
      "initial_release_date": "2026-03-03T18:12:12.361000+00:00",
      "product_status:known_affected": "162",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "MariaDB: MariaDB: Information disclosure due to unlogged SQL statements with comments",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3494.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-18T17:05:39Z",
      "cve": "CVE-2026-3494",
      "id": "CVE-2026-3494",
      "initial_release_date": "2026-03-05T06:52:34Z",
      "product_status:known_affected": "36",
      "product_status:recommended": "150",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-3494",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-3494.json",
      "version": "8"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-3494\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-03T18:56:25.959459Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-03T18:56:28.318Z\"}}], \"cna\": {\"title\": \"MariaDB Server Audit Plugin Comment Handling Bypass\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-93\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-93 (Log Injection-Tampering-Forging)\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"MariaDB Foundation\", \"product\": \"MariaDB Server\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"10.6.25\"}, {\"status\": \"unaffected\", \"version\": \"10.11.16\"}, {\"status\": \"unaffected\", \"version\": \"11.4.10\"}, {\"status\": \"unaffected\", \"version\": \"11.8.6\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Amazon\", \"product\": \"Aurora MySQL\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.12.6\"}, {\"status\": \"unaffected\", \"version\": \"3.04.6\"}, {\"status\": \"unaffected\", \"version\": \"3.10.3\"}, {\"status\": \"unaffected\", \"version\": \"3.11.1\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Amazon\", \"product\": \"RDS for MySQL\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.7.44-RDS.20260212\"}, {\"status\": \"unaffected\", \"version\": \"8.0.45\"}, {\"status\": \"unaffected\", \"version\": \"8.4.8\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Amazon\", \"product\": \"RDS for MariaDB\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"10.6.25\"}, {\"status\": \"unaffected\", \"version\": \"10.11.16\"}, {\"status\": \"unaffected\", \"version\": \"11.4.10\"}, {\"status\": \"unaffected\", \"version\": \"11.8.6\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://aws.amazon.com/security/security-bulletins/2026-006-AWS/\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (\\u2014) or hash (#) style comments, the statement is not logged.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (\\u2014) or hash (#) style comments, the statement is not logged.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-778\", \"description\": \"CWE-778 (Insufficient Logging)\"}]}], \"providerMetadata\": {\"orgId\": \"ff89ba41-3aa1-4d27-914a-91399e9639e5\", \"shortName\": \"AMZN\", \"dateUpdated\": \"2026-03-16T17:03:08.613Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-3494\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-16T17:03:08.613Z\", \"dateReserved\": \"2026-03-03T17:26:55.939Z\", \"assignerOrgId\": \"ff89ba41-3aa1-4d27-914a-91399e9639e5\", \"datePublished\": \"2026-03-03T18:12:12.361Z\", \"assignerShortName\": \"AMZN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-07584

Vulnerability from fstec - Published: 03.03.2026

Title

Уязвимость плагина server audit plugin системы управления базами данных MariaDB, позволяющая нарушителю обойти существующие механизмы безопасности

Description

Уязвимость плагина server audit plugin системы управления базами данных MariaDB связана с ошибками в настройках безопасности. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти существующие механизмы безопасности

Severity


                    
                      AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Vendor

ООО «Ред Софт», MariaDB Foundation, Amazon.com Inc.

Software Name

РЕД ОС (запись в едином реестре российских программ №3751), MariaDB, Aurora MySQL, Amazon RDS for MySQL, Amazon RDS for MariaDB

Software Version

7.3 (РЕД ОС), 8.0 (РЕД ОС), до 10.6.24 включительно (MariaDB), до 10.11.15 включительно (MariaDB), до 11.4.9 включительно (MariaDB), до 11.8.5 включительно (MariaDB), до 2.12.5 включительно (Aurora MySQL), от 3.01.0 до 3.04.5 включительно (Aurora MySQL), от 3.05.1 до 3.10.2 включительно (Aurora MySQL), 3.11.0 (Aurora MySQL), до 5.7.44-RDS.20251212 включительно (Amazon RDS for MySQL), от 8.0.11 до 8.0.44 включительно (Amazon RDS for MySQL), от 8.4.3 до 8.4.7 включительно (Amazon RDS for MySQL), до 10.6.24 включительно (Amazon RDS for MariaDB), от 10.11.4 до 10.11.15 включительно (Amazon RDS for MariaDB), от 11.4.3 до 11.4.9 включительно (Amazon RDS for MariaDB), от 11.8.3 до 11.8.5 включительно (Amazon RDS for MariaDB)

Possible Mitigations

Использование рекомендаций: Для MariaDB: https://aws.amazon.com/ru/security/security-bulletins/2026-006-AWS/ Для Ред ОС: https://redos.red-soft.ru/search/?iblock_id=&q=CVE-2026-3494

Reference

https://aws.amazon.com/ru/security/security-bulletins/2026-006-AWS/ https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261 https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff https://github.com/KKongTen/CVE-2026-3494_Verfication https://redos.red-soft.ru/search/?iblock_id=&q=CVE-2026-3494

CWE

CWE-778

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, MariaDB Foundation, Amazon.com Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7.3 (\u0420\u0415\u0414 \u041e\u0421), 8.0 (\u0420\u0415\u0414 \u041e\u0421), \u0434\u043e 10.6.24 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (MariaDB), \u0434\u043e 10.11.15 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (MariaDB), \u0434\u043e 11.4.9 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (MariaDB), \u0434\u043e 11.8.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (MariaDB), \u0434\u043e 2.12.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Aurora MySQL), \u043e\u0442 3.01.0 \u0434\u043e 3.04.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Aurora MySQL), \u043e\u0442 3.05.1 \u0434\u043e 3.10.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Aurora MySQL), 3.11.0 (Aurora MySQL), \u0434\u043e 5.7.44-RDS.20251212 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Amazon RDS for MySQL), \u043e\u0442 8.0.11 \u0434\u043e 8.0.44 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Amazon RDS for MySQL), \u043e\u0442 8.4.3 \u0434\u043e 8.4.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Amazon RDS for MySQL), \u0434\u043e 10.6.24 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Amazon RDS for MariaDB), \u043e\u0442 10.11.4 \u0434\u043e 10.11.15 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Amazon RDS for MariaDB), \u043e\u0442 11.4.3 \u0434\u043e 11.4.9 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Amazon RDS for MariaDB), \u043e\u0442 11.8.3 \u0434\u043e 11.8.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Amazon RDS for MariaDB)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f MariaDB:\nhttps://aws.amazon.com/ru/security/security-bulletins/2026-006-AWS/\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421:\nhttps://redos.red-soft.ru/search/?iblock_id=\u0026q=CVE-2026-3494",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "03.03.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "01.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "01.06.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-07584",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-3494",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "\u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), MariaDB, Aurora MySQL, Amazon RDS for MySQL, Amazon RDS for MariaDB",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d\u0430 server audit plugin \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 MariaDB, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f (CWE-778)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d\u0430 server audit plugin \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 MariaDB \u0441\u0432\u044f\u0437\u0430\u043d\u0430  \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u043e\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://aws.amazon.com/ru/security/security-bulletins/2026-006-AWS/\nhttps://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261\nhttps://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff\nhttps://github.com/KKongTen/CVE-2026-3494_Verfication\nhttps://redos.red-soft.ru/search/?iblock_id=\u0026q=CVE-2026-3494",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0421\u0423\u0411\u0414",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-778",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,3)"
}

bit-mariadb-2026-3494

Vulnerability from bitnami_vulndb

Published

2026-03-10 08:46

Modified

2026-09-08 08:34

Summary

MariaDB Server Audit Plugin Comment Handling Bypass

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "mariadb",
        "purl": "pkg:bitnami/mariadb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.6.25"
            },
            {
              "introduced": "10.7.0"
            },
            {
              "fixed": "10.11.16"
            },
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.4.10"
            },
            {
              "introduced": "11.5.0"
            },
            {
              "fixed": "11.8.6"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "type": "CVSS_V4"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-3494"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (\u2014) or hash (#) style comments, the statement is not logged.",
  "id": "BIT-mariadb-2026-3494",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2026-03-10T08:46:18.025Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://aws.amazon.com/security/security-bulletins/2026-006-AWS/"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3494"
    },
    {
      "type": "FIX",
      "url": "https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261"
    },
    {
      "type": "FIX",
      "url": "https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "MariaDB Server Audit Plugin Comment Handling Bypass"
}

CERTFR-2026-AVI-0258

Vulnerability from certfr_avis - Published: 2026-03-10 - Updated: 2026-03-10

Une vulnérabilité a été découverte dans Microsoft CBL-Mariner. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Microsoft	N/A	cbl2 mariadb 10.6.24-1 versions antérieures à 10.6.25-1

References

Title

Publication Time

FKIE_CVE-2026-3494

Vulnerability from fkie_nvd - Published: 2026-03-03 20:16 - Updated: 2026-07-14 15:43

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

References

URL	Tags
ff89ba41-3aa1-4d27-914a-91399e9639e5	https://aws.amazon.com/security/security-bulletins/2026-006-AWS/	Third Party Advisory
ff89ba41-3aa1-4d27-914a-91399e9639e5	https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261	Patch
ff89ba41-3aa1-4d27-914a-91399e9639e5	https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff	Patch

Impacted products

Vendor	Product	Version
mariadb	mariadb	*
mariadb	mariadb	*
mariadb	mariadb	*
mariadb	mariadb	*
amazon	aurora_mysql	*
amazon	aurora_mysql	*
amazon	aurora_mysql	*
amazon	aurora_mysql	3.11.0
amazon	relational_database_service	*
amazon	relational_database_service	*
amazon	relational_database_service	*
amazon	relational_database_service	*
amazon	relational_database_service	*
amazon	relational_database_service	*
amazon	relational_database_service	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "MariaDB Server",
          "vendor": "MariaDB Foundation",
          "versions": [
            {
              "status": "unaffected",
              "version": "10.6.25"
            },
            {
              "status": "unaffected",
              "version": "10.11.16"
            },
            {
              "status": "unaffected",
              "version": "11.4.10"
            },
            {
              "status": "unaffected",
              "version": "11.8.6"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Aurora MySQL",
          "vendor": "Amazon",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.12.6"
            },
            {
              "status": "unaffected",
              "version": "3.04.6"
            },
            {
              "status": "unaffected",
              "version": "3.10.3"
            },
            {
              "status": "unaffected",
              "version": "3.11.1"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "RDS for MySQL",
          "vendor": "Amazon",
          "versions": [
            {
              "status": "unaffected",
              "version": "5.7.44-RDS.20260212"
            },
            {
              "status": "unaffected",
              "version": "8.0.45"
            },
            {
              "status": "unaffected",
              "version": "8.4.8"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "RDS for MariaDB",
          "vendor": "Amazon",
          "versions": [
            {
              "status": "unaffected",
              "version": "10.6.25"
            },
            {
              "status": "unaffected",
              "version": "10.11.16"
            },
            {
              "status": "unaffected",
              "version": "11.4.10"
            },
            {
              "status": "unaffected",
              "version": "11.8.6"
            }
          ]
        }
      ],
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A30EA78-32F5-4C1B-A67A-23DC6C7B72EB",
              "versionEndIncluding": "10.6.24",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "332B395C-4839-4615-B00B-E4D441F2CD0A",
              "versionEndIncluding": "10.11.15",
              "versionStartIncluding": "10.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A26387F9-8443-4057-A5E1-441377F32CDB",
              "versionEndIncluding": "11.4.9",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2088E08-6CAF-4EA5-BF0D-1E5F7D895EAE",
              "versionEndIncluding": "11.8.5",
              "versionStartIncluding": "11.5.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:amazon:aurora_mysql:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "47D5C055-479D-48B1-9A1B-96A03A991BF7",
              "versionEndIncluding": "2.12.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:aurora_mysql:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D6AC3BC-CEF0-4D92-9FA6-7BC11C0F59D5",
              "versionEndExcluding": "3.04.6",
              "versionStartIncluding": "3.01.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:aurora_mysql:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "71F2AFB8-E9B5-41BB-9FA6-5FD6DF742609",
              "versionEndIncluding": "3.10.2",
              "versionStartIncluding": "3.05.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:aurora_mysql:3.11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6548276-890D-4BAA-B63C-2589276CB05B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mysql:*:*",
              "matchCriteriaId": "19020403-62DD-4582-94FC-C942145BE41C",
              "versionEndIncluding": "5.7.44-rds.20251212",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:*",
              "matchCriteriaId": "D726E50A-7EF5-416D-A87A-2BF960AD2FE8",
              "versionEndIncluding": "10.6.24",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mysql:*:*",
              "matchCriteriaId": "D0E5AB60-5EAB-4425-A5ED-D7A4C885412B",
              "versionEndIncluding": "8.0.44",
              "versionStartIncluding": "8.0.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mysql:*:*",
              "matchCriteriaId": "245D28E5-72B2-425D-B45A-A8FF86253512",
              "versionEndIncluding": "8.4.7",
              "versionStartIncluding": "8.4.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:*",
              "matchCriteriaId": "231A1730-3772-4CBD-9987-88261193DE56",
              "versionEndIncluding": "10.11.15",
              "versionStartIncluding": "10.11.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:*",
              "matchCriteriaId": "BAFD31F7-359F-4CC7-8DDF-4543EB8478D7",
              "versionEndIncluding": "11.4.9",
              "versionStartIncluding": "11.4.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:amazon:relational_database_service:*:*:*:*:*:mariadb:*:*",
              "matchCriteriaId": "06BB3DE6-41A1-4D83-B3ED-E3200E8A414B",
              "versionEndIncluding": "11.8.5",
              "versionStartIncluding": "11.8.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (\u2014) or hash (#) style comments, the statement is not logged."
    },
    {
      "lang": "es",
      "value": "En la versi\u00f3n del servidor MariaDB hasta la 11.8.5, cuando el plugin de auditor\u00eda del servidor est\u00e1 habilitado con la variable server_audit_events configurada con el filtrado QUERY_DCL, QUERY_DDL o QUERY_DML, si un usuario de base de datos autenticado invoca una instrucci\u00f3n SQL prefijada con comentarios estilo doble guion (\u2014) o almohadilla (#), la instrucci\u00f3n no se registra."
    }
  ],
  "id": "CVE-2026-3494",
  "lastModified": "2026-07-14T15:43:43.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-3494",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-03T18:56:25.959459Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-03T20:16:50.667",
  "references": [
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://aws.amazon.com/security/security-bulletins/2026-006-AWS/"
    },
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261"
    },
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"
    }
  ],
  "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-778"
        }
      ],
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-QMJM-438J-W485

Vulnerability from github – Published: 2026-03-03 21:31 – Updated: 2026-03-16 18:32

Details

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-3494"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-778"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-03T20:16:50Z",
    "severity": "MODERATE"
  },
  "details": "In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (\u2014) or hash (#) style comments, the statement is not logged.",
  "id": "GHSA-qmjm-438j-w485",
  "modified": "2026-03-16T18:32:03Z",
  "published": "2026-03-03T21:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3494"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"
    },
    {
      "type": "WEB",
      "url": "https://aws.amazon.com/security/security-bulletins/2026-006-AWS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

MSRC_CVE-2026-3494

Vulnerability from csaf_microsoft - Published: 2026-03-02 00:00 - Updated: 2026-03-14 01:37

Summary

MariaDB Server Audit Plugin Comment Handling Bypass

Scope

1 vulnerability in this advisory, including CVE-2026-3494.

CVE-2026-3494

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fixed: 2 products Known affected: 2 products

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

OPENSUSE-SU-2026:10897-1

Vulnerability from csaf_opensuse - Published: 2026-05-29 00:00 - Updated: 2026-05-29 00:00

Summary

libmariadbd-devel-11.8.7-1.1 on GA media

Severity

Moderate

Scope

9 vulnerabilities in this advisory, including CVE-2026-3494.

CVE-2026-3494

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Recommended: 40 products

Open the full advisory

SUSE-SU-2026:22095-1

Vulnerability from csaf_suse - Published: 2026-06-10 09:53 - Updated: 2026-06-10 09:53

Summary

Security update for mariadb

Severity

Critical

Scope

12 vulnerabilities in this advisory, including CVE-2026-3494.

CVE-2026-3494

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Recommended: 50 products

Open the full advisory

SUSE-SU-2026:2282-1

Vulnerability from csaf_suse - Published: 2026-06-05 12:14 - Updated: 2026-06-05 12:14

Summary

Security update for mariadb

Severity

Critical

Scope

9 vulnerabilities in this advisory, including CVE-2026-3494.

CVE-2026-3494

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Recommended: 108 products

Open the full advisory

SUSE-SU-2026:2284-1

Vulnerability from csaf_suse - Published: 2026-06-05 12:16 - Updated: 2026-06-05 12:16

Summary

Security update for mariadb

Severity

Critical

Scope

10 vulnerabilities in this advisory, including CVE-2026-3494.

CVE-2026-3494

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Recommended: 32 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-3494 (GCVE-0-2026-3494)

Vulnerability from bitnami_vulndb

Solutions

Tags

Sightings

Nomenclature

Related by attack behaviour