CVE-2026-44170 is a critical OS command injection (CVSS 9.8 in the record) in MariaDB Server on Windows when the CONNECT engine is installed and REST support is enabled. The table HTTP attribute is placed into a curl command line unsanitized. Upgrade to 10.6.26, 10.11.17, 11.4.11, 11.8.7 or 12.3.2.
What's affected
From the project advisory, MariaDB Server on Windows is affected in these ranges:
- 10.6.1 to 10.6.25, fixed in 10.6.26
- 10.11.1 to 10.11.16, fixed in 10.11.17
- 11.4.1 to 11.4.10, fixed in 11.4.11
- 11.8.1 to 11.8.6, fixed in 11.8.7
- 12.3.1, fixed in 12.3.2
Exposure needs three things at once: a Windows host, the CONNECT storage engine installed, and its REST support enabled. The project rates the issue as moderate, while the NVD record scores it 9.8. Servers on Linux, or Windows servers without CONNECT, do not meet the stated conditions.
How to check if you're exposed
Check the server version and whether the CONNECT engine is present. In a SQL session:
SELECT VERSION();
SHOW ENGINES;
If CONNECT appears in the engine list, check whether any tables use it with an HTTP attribute, and whether REST support was built in or configured. On Windows, the installed features list in your installer or package record also shows whether CONNECT was added.
Linux packages from distributions may carry their own advisories. The record links several Red Hat errata, so check your vendor notices if you use their builds.
What to do now
- Upgrade MariaDB Server to the fixed release for your branch from the list above.
- If CONNECT is not needed, uninstall the engine, or at least turn off REST support.
- Limit who can create or alter CONNECT tables, since the table definition carries the HTTP attribute.
- Review existing CONNECT table definitions for unexpected HTTP attributes.
Why it matters
The weakness is CWE-78 (OS command injection). The engine built a curl command line by inserting a value from the table definition without cleaning it, so crafted text could add its own shell syntax.
The people who can trigger it are those who can create or edit tables that use the engine. On shared database servers that group can be larger than the administrators. Because the process runs commands on the host, the damage is limited by the account the database service runs under.
The record does not mark this CVE as KEV. The fix is in the engine code, so there is no configuration that fully replaces upgrading, but removing an unused engine takes the exposure away.
Quick check
Does this affect MariaDB on Linux?
The advisory limits it to Windows with the CONNECT engine and REST support. Check your build if you are unsure.
Is the CONNECT engine installed by default?
Not necessarily. Run SHOW ENGINES to see whether it is present on your server.
Sources
Last reviewed: 19 October 2026.
