PT-2026-24609 · Bitnami · Mariadb

Published 2026-03-10 · Updated 2026-03-10

OSV

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server audit events variable configured with QUERY DCL, QUERY DDL, or QUERY DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

Related Identifiers

BIT-MARIADB-2026-3494

Affected Products

Mariadb

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3494 · Security Note
• https://osv.dev/vulnerability/BIT-mariadb-2026-3494 · Vendor Advisory
• https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261 · Note
• https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff · Note
• https://aws.amazon.com/security/security-bulletins/2026-006-AWS · Note