PT-2026-22790 · Mariadb Foundation+1 · Mariadb+1

Published 2026-03-03 · Updated 2026-05-29 · CVE-2026-3494

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MariaDB versions through 11.8.5

Description When the server audit plugin is enabled with the server audit events variable configured with QUERY DCL, QUERY DDL, or QUERY DML filtering, SQL statements prefixed with double-hyphen (—) or hash (#) style comments, invoked by an authenticated database user, are not logged. This occurs in MariaDB server versions through 11.8.5.

Recommendations Versions prior to 11.8.6 should be updated.

Exploit

Fix

DoS

Weakness Enumeration

CWE-778

Related Identifiers

AZL-79365

AZL-79550

BDU:2026-07584

BIT-MARIADB-2026-3494

BIT-MARIADB-MIN-2026-3494

BIT-MYSQL-CLIENT-2026-3494

CVE-2026-3494

OESA-2026-2395

OESA-2026-2396

OESA-2026-2397

OPENSUSE-SU-2026:10897-1

Affected Products

Mariadb

Red Os

References · 47

• 🔥 https://github.com/KKongTen/CVE-2026-3494_Verfication · Exploit
• https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261 · Patch
• https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff · Patch
• https://osv.dev/vulnerability/OESA-2026-2395 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10897-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mysql-client-2026-3494 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3494 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13699 · Security Note
• https://osv.dev/vulnerability/AZL-79550 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07584 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-3494 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-79365 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3494 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-3494 · Vendor Advisory