CVE-2026-44170

EUVD-2026-36513

12.06.2026, 18:16

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

OS Command Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 69.48%

Affected Products (NVD)

Vendor	Product	Version
mariadb	mariadb	10.6.1 ≤ 𝑥 < 10.6.26
mariadb	mariadb	10.11.1 ≤ 𝑥 < 10.11.17
mariadb	mariadb	11.4.1 ≤ 𝑥 < 11.4.11
mariadb	mariadb	11.8.1 ≤ 𝑥 < 11.8.7
mariadb	mariadb	12.3.1

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Enterprise Linux 10	3:10.11.18-1.el10_2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 10	3:11.8.8-1.el10_2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	3:10.11.18-1.el10_0 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8	8100020260616102001.489197e6 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	9080020260612104015.rhel9 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	9080020260612103452.rhel9 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Hardened Images	11.8.8-1.hum1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Hardened Images	10.11.18-1.hum1 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

mariadb

bookworm	1:10.11.18-0+deb12u1 fixed
forky	1:11.8.8-1 fixed
sid	1:11.8.9+ds-2 fixed
trixie	1:11.8.6-0+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

mariadb

jammy	dne
noble	not-affected
questing	ignored
resolute	not-affected

mariadb-10.0

jammy	dne
noble	dne
questing	dne
resolute	dne
xenial	not-affected

mariadb-10.1

bionic	not-affected
jammy	dne
noble	dne
questing	dne
resolute	dne

mariadb-10.3

focal	not-affected
jammy	dne
noble	dne
questing	dne
resolute	dne

mariadb-10.6

jammy	not-affected
noble	dne
questing	dne
resolute	dne

openSUSE / SLES Releases

openSUSE Product

Release

libmariadbd-devel

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

libmariadbd19

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb-client

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb-errormessages

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb-tools

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

Common Weakness Enumeration

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References

https://github.com/MariaDB/server/security/advisories/GHSA-f835-cfjq-wf73

https://jira.mariadb.org/browse/MDEV-39289

https://access.redhat.com/errata/RHSA-2026:25143

https://access.redhat.com/errata/RHSA-2026:25145

https://access.redhat.com/errata/RHSA-2026:33093

https://access.redhat.com/errata/RHSA-2026:33412

https://access.redhat.com/errata/RHSA-2026:33464

https://access.redhat.com/errata/RHSA-2026:33481

https://access.redhat.com/errata/RHSA-2026:33482

https://access.redhat.com/errata/RHSA-2026:49522

https://access.redhat.com/security/cve/CVE-2026-44170

https://bugzilla.redhat.com/show_bug.cgi?id=2488451

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44170.json