PT-2026-45148 · Mariadb Foundation+1 · Mariadb+1

Osidb Bzimport · CVE-2026-44170 · Published 2026-05-26 · Updated 2026-06-30

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MariaDB versions 10.6.1 through 10.6.25 MariaDB versions 10.11.1 through 10.11.16 MariaDB versions 11.4.1 through 11.4.10 MariaDB versions 11.8.1 through 11.8.6 MariaDB version 12.3.1

Description On Windows, when the CONNECT engine is installed and REST support is enabled, the software fails to properly sanitize the HTTP attribute of interpolated tables before including it in the curl command line. This allows a user to execute shell commands on the server.

Recommendations Update versions 10.6.1 through 10.6.25 to 10.6.26. Update versions 10.11.1 through 10.11.16 to 10.11.17. Update versions 11.4.1 through 11.4.10 to 11.4.11. Update versions 11.8.1 through 11.8.6 to 11.8.7. Update version 12.3.1 to 12.3.2.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BIT-MARIADB-2026-44170

BIT-MARIADB-MIN-2026-44170

BIT-MYSQL-CLIENT-2026-44170

CVE-2026-44170

ECHO-22F4-4100-B032

GHSA-F835-CFJQ-WF73

OPENSUSE-SU-2026:10897-1

OPENSUSE-SU-2026:20933-1

RHSA-2026:25143

RHSA-2026:25145

RHSA-2026:33412

RHSA-2026:33464

RHSA-2026:33481

RHSA-2026:33482

SUSE-SU-2026:22095-1

SUSE-SU-2026:2282-1

SUSE-SU-2026:2284-1

SUSE-SU-2026:2330-1

Affected Products

Mariadb

Rocky Linux

References · 65

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44170.json · Exploit
• https://access.redhat.com/errata/RHSA-2026:33481 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22095-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:33481 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44170 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2330-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25145 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20933-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:33482 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mariadb-2026-44170 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:33093 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-44170 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44170 · Security Note
• https://access.redhat.com/errata/RHSA-2026:25143 · Vendor Advisory