On 9 October 2026, NVD published five CVEs for MariaDB server, CVE-2026-107814 to CVE-2026-107818. They are fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Two score 8.4, one scores 8.5, and the rest are medium.
Read the conditions before the scores. The server bugs need an authenticated database user, and two need the FILE privilege, which most application accounts should never have.
What's affected
All five affect the same ranges: from 10.6.1 until the fixed releases above.
| CVE | Requires | Problem | NVD score |
|---|---|---|---|
| CVE-2026-107814 | FILE privilege, RPM packages | mysql service account home is the data directory, so dot files like .bash_profile can be written and run on an admin login shell | 8.4 |
| CVE-2026-107818 | FILE privilege and secure-file-priv allowing /run/mysqld | Writes /run/mysqld/wsrep-new-cluster and injects environment values into the restarted service | 8.4 |
| CVE-2026-107815 | Authenticated user able to use the CONNECT engine | Stack buffer one byte null write in the DOS table type, crash and possibly code execution | 8.5 |
| CVE-2026-107816 | Authenticated user | qc_info plugin and null bytes in a cached query, memory disclosure or crash | 6.4 |
| CVE-2026-107817 | Ability to import a crafted MySQL table | mysql_json plugin assumes valid binary JSON, out of bounds read or crash | 4.4 |
Debian packages are not affected by CVE-2026-107814, because they use /nonexistent as the account home, according to the CVE text. Separately, CVE-2026-107819 covers MariaDB Connector/C 3.4.1 until 3.4.10: a hostname mismatch in zero configuration TLS was not rejected, so a man in the middle with a valid certificate for another host could request mysql_clear_password. NVD scores it 5.9 and says other MariaDB connectors are not affected.
How to check if you're exposed
Server version and plugins:
SELECT VERSION();
SHOW PLUGINS;
SHOW GLOBAL VARIABLES LIKE 'secure_file_priv';
Who holds FILE:
SELECT grantee FROM information_schema.user_privileges WHERE privilege_type = 'FILE';
Any account other than administrators is a red flag. Then check the service account home on RPM based hosts:
getent passwd mysql
systemctl cat mariadb | grep -i wsrep
If the home directory is your datadir, the dot file route in CVE-2026-107814 applies. Look for stray files there:
ls -la /var/lib/mysql | grep ' \.[a-z_]'
CONNECT is exposed only if the engine is loaded, which SHOW PLUGINS tells you.
What to do now
- Upgrade to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 or 13.0.2, matching your series. Upgrade Connector/C to 3.4.10 or later where you use it.
- Revoke FILE from every account that does not truly need it, and set secure_file_priv to a dedicated directory that is not /run/mysqld or the data directory.
- If CONNECT is not used, do not load it.
- Check the mysql user's home directory for dot files you did not put there.
- Review who can import MySQL tables through the mysql_json path.
Why it matters
FILE is a classic privilege that people hand out without noticing. Combined with how packages set up the service account, it was enough to reach the host. The two RPM and systemd issues were packaging flaws, not code bugs, which is a reminder to inspect how a database package configures the OS around it.
Check the fixed version of your actual package, not the upstream number. If your distro backports fixes, it may keep the old version string.
Quick check
Your applications connect as users without FILE and CONNECT is not loaded. What is left?
The authenticated qc_info and mysql_json issues, which still need patching, and the Connector/C TLS issue if your clients use it.
