CVE-2026-3494

mediumpriority · track · 10EPSS 0.003 · 21 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.29% (21st) EPSS

CVSS 4.3 · medium

Is it mine?

53 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.1–5.3

v3.14.3mediumAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nsecondaryexploitability 2.8 · impact 1.4

v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary

v4.02.1lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-778USCWE-778US

exploits (1)

Public proof-of-concept and weaponised exploit code.

Kelnor/CVE-2026-3494_VerficationReproduction and Analysis of CVE-2026-3494PoC · poc_in_github

affected products (53)

Products and version ranges known to be affected.

MariaDB MariaDB <10.11.16all versionscert_bundDE
MariaDB MariaDB <10.6.25all versionscert_bundDE
MariaDB MariaDB <11.4.10all versionscert_bundDE
MariaDB MariaDB <11.8.6all versionscert_bundDE
Microsoft Azure Linux azl3all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
MariaDB MariaDB< 10.11.16cert_bundDE
MariaDB MariaDB< 10.6.25cert_bundDE
MariaDB MariaDB< 11.4.10cert_bundDE
MariaDB MariaDB< 11.8.6cert_bundDE
Amazon.com Inc. Amazon RDS for MariaDB≤ 10.6.24fstec_bduRU
Amazon.com Inc. Amazon RDS for MariaDB10.11.4 → 10.11.15fstec_bduRU
Amazon.com Inc. Amazon RDS for MariaDB11.4.3 → 11.4.9fstec_bduRU
Amazon.com Inc. Amazon RDS for MariaDB11.8.3 → 11.8.5fstec_bduRU
Amazon.com Inc. Amazon RDS for MySQL≤ 5.7.44-RDS.20251212fstec_bduRU
Amazon.com Inc. Amazon RDS for MySQL8.0.11 → 8.0.44fstec_bduRU
Amazon.com Inc. Amazon RDS for MySQL8.4.3 → 8.4.7fstec_bduRU
Amazon.com Inc. Aurora MySQL≤ 2.12.5fstec_bduRU
Amazon.com Inc. Aurora MySQL≤ 3.11.0fstec_bduRU
Amazon.com Inc. Aurora MySQL3.01.0 → 3.04.5fstec_bduRU

showing 20 of 53

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0585MariaDB (Server Audit Plugin): Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-03-03csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MariaDB ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
BIT-mariadb-2026-3494MariaDB Server Audit Plugin Comment Handling Bypass2026-03-10vendor · osvUS
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
BIT-mariadb-min-2026-3494MariaDB Server Audit Plugin Comment Handling Bypass2026-03-10vendor · osvUS
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
BIT-mysql-client-2026-3494MariaDB Server Audit Plugin Comment Handling Bypass2026-03-10vendor · osvUS
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

also known as (7)

Other names and identifiers for this entity.

CNNVD-202603-287 cnnvd
EUVD-2026-9311 enisa_euvd
BDU:2026-07584 fstec_bdu
GHSA-qmjm-438j-w485 enisa_euvd
BIT-mariadb-2026-3494osv
BIT-mariadb-min-2026-3494osv
BIT-mysql-client-2026-3494osv

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

published 2026-03-03modified 2026-10-20

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan