p PatchFirst

CVE-2026-3494

CVE-2026-3494 · MariaDB Server Audit Plugin Comment Handling Bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • mariadb server

    Versions
    • ≥ 0, < 10.6.25: Affected (custom)
    • ≥ 0, < 10.11.16: Affected (custom)
    • ≥ 0, < 11.4.10: Affected (custom)
    • ≥ 0, < 11.8.6: Affected (custom)

    Update to 10.6.25

  • aurora mysql

    Versions
    • ≥ 0, < 2.12.6: Affected (custom)
    • ≥ 0, < 3.04.6: Affected (custom)
    • ≥ 0, < 3.10.3: Affected (custom)
    • ≥ 0, < 3.11.1: Affected (custom)

    Update to 2.12.6

  • rds for mysql

    Versions
    • ≥ 0, < 5.7.44-RDS.20260212: Affected (custom)
    • ≥ 0, < 8.0.45: Affected (custom)
    • ≥ 0, < 8.4.8: Affected (custom)

    Update to 5.7.44-RDS.20260212

  • rds for mariadb

    Versions
    • ≥ 0, < 10.6.25: Affected (custom)
    • ≥ 0, < 10.11.16: Affected (custom)
    • ≥ 0, < 11.4.10: Affected (custom)
    • ≥ 0, < 11.8.6: Affected (custom)

    Update to 10.6.25

  • mariadb Debian:12

    Versions
    • 1:10.11.11-0+deb12u1
    • 1:10.11.13-0+deb12u1
    • 1:10.11.14-0+deb12u1
    • 1:10.11.14-0+deb12u2
    • 1:10.11.3-1
    • 1:10.11.3-2~exp1
    • 1:10.11.4-1
    • 1:10.11.4-1~deb12u1
    • 1:10.11.5-1
    • 1:10.11.5-2
    • 1:10.11.5-3
    • 1:10.11.6-0+deb12u1
    • 1:10.11.6-1
    • 1:10.11.6-2
    • 1:10.11.6-2.1~exp1
    • 1:10.11.7-1
    • 1:10.11.7-2
    • 1:10.11.7-3
    • 1:10.11.7-4
    • 1:10.11.8-1
    • 1:10.11.9-0+deb12u1
    Affected ranges
    • ECOSYSTEM: < 1:10.11.18-0+deb12u1

    Update to 1:10.11.18-0+deb12u1

  • mariadb Debian:13

    Versions
    • 1:11.8.2-1
    • 1:11.8.3-0+deb13u1
    • 1:11.8.3-1
    • 1:11.8.5-1
    • 1:11.8.5-2
    • 1:11.8.5-3
    • 1:11.8.5-3~exp1
    • 1:11.8.5-3~exp2
    • 1:11.8.5-3~exp3
    • 1:11.8.5-4
    Affected ranges
    • ECOSYSTEM: < 1:11.8.6-0+deb13u1

    Update to 1:11.8.6-0+deb13u1

  • mariadb Debian:14

    Versions
    • 1:11.8.2-1
    • 1:11.8.3-1
    • 1:11.8.5-1
    • 1:11.8.5-2
    • 1:11.8.5-3
    • 1:11.8.5-3~exp1
    • 1:11.8.5-3~exp2
    • 1:11.8.5-3~exp3
    • 1:11.8.5-4
    Affected ranges
    • ECOSYSTEM: < 1:11.8.6-1

    Update to 1:11.8.6-1

  • mariadb-10.0 Ubuntu:16.04:LTS

    Versions
    • 10.0.20-0ubuntu0.15.04.1
    • 10.0.22-0ubuntu1
    • 10.0.23-1
    • 10.0.23-2
    • 10.0.24-7
    • 10.0.25-0ubuntu0.16.04.1
    • 10.0.27-0ubuntu0.16.04.1
    • 10.0.28-0ubuntu0.16.04.1
    • 10.0.29-0ubuntu0.16.04.1
    • 10.0.31-0ubuntu0.16.04.2
    • 10.0.33-0ubuntu0.16.04.1
    • 10.0.34-0ubuntu0.16.04.1
    • 10.0.36-0ubuntu0.16.04.1
    • 10.0.38-0ubuntu0.16.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb-10.1 Ubuntu:18.04:LTS

    Versions
    • 10.1.25-1
    • 1:10.1.29-6
    • 1:10.1.34-0ubuntu0.18.04.1
    • 1:10.1.38-0ubuntu0.18.04.1
    • 1:10.1.38-0ubuntu0.18.04.2
    • 1:10.1.40-0ubuntu0.18.04.1
    • 1:10.1.41-0ubuntu0.18.04.1
    • 1:10.1.43-0ubuntu0.18.04.1
    • 1:10.1.44-0ubuntu0.18.04.1
    • 1:10.1.47-0ubuntu0.18.04.1
    • 1:10.1.48-0ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb-10.3 Ubuntu:20.04:LTS

    Versions
    • 1:10.3.17-1
    • 1:10.3.18-1
    • 1:10.3.19-1
    • 1:10.3.21-2
    • 1:10.3.22-1
    • 1:10.3.22-1ubuntu1
    • 1:10.3.25-0ubuntu0.20.04.1
    • 1:10.3.29-0ubuntu0.20.04.1
    • 1:10.3.30-0ubuntu0.20.04.1
    • 1:10.3.31-0ubuntu0.20.04.1
    • 1:10.3.32-0ubuntu0.20.04.1
    • 1:10.3.34-0ubuntu0.20.04.1
    • 1:10.3.37-0ubuntu0.20.04.1
    • 1:10.3.38-0ubuntu0.20.04.1
    • 1:10.3.39-0ubuntu0.20.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb-10.6 Ubuntu:22.04:LTS

    Versions
    • 1:10.6.7-2ubuntu1
    • 1:10.6.7-2ubuntu1.1
    • 1:10.6.11-0ubuntu0.22.04.1
    • 1:10.6.12-0ubuntu0.22.04.1
    • 1:10.6.16-0ubuntu0.22.04.1
    • 1:10.6.18-0ubuntu0.22.04.1
    • 1:10.6.21-0ubuntu0.22.04.2
    • 1:10.6.22-0ubuntu0.22.04.1
    • 1:10.6.23-0ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb Ubuntu:24.04:LTS

    Versions
    • 1:10.11.4-1
    • 1:10.11.5-3
    • 1:10.11.6-1
    • 1:10.11.6-2
    • 1:10.11.7-2ubuntu1
    • 1:10.11.7-2ubuntu2
    • 1:10.11.8-0ubuntu0.24.04.1
    • 1:10.11.11-0ubuntu0.24.04.2
    • 1:10.11.13-0ubuntu0.24.04.1
    • 1:10.11.14-0ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →