MariaDB has released fixes for a series of serious vulnerabilities that, under certain configurations, could allow attackers to execute code, read or modify protected database tables, and steal login credentials. While one of the most alarming flaws has earned a “High” risk rating—not “Critical”—the potential impact is severe if servers are misconfigured. All server branches and the Connector/C component are implicated. Systems relying on unsafe settings, elevated permissions, or unused plugins are especially exposed.
What’s broken: RCE and permissions bypasses
The most notable issue, CVE-2026-107815, is a memory corruption vulnerability in the CONNECT storage engine. It carries a CVSS score of 8.5 and was shown in lab tests to allow remote code execution. Attackers require only minimal privileges, high skill, and no user interaction, though exploitation depends on having the CONNECT engine installed. Vendors recommend uninstalling the CONNECT plugin if it’s not needed. This flaw stems from a faulty boundary check that enables writing a zero byte just past the end of a stack buffer. Even this one-byte overflow was enough to corrupt memory in a manner that enables code execution.
Another serious bug, CVE-2026-107821, affects MariaDB’s handling of binary .frm files when opening tables. Maliciously crafted files can induce crashes, out-of-bounds memory access, and potentially remote code execution. Exploitation requires having the FILE privilege and a permissive secure-file-priv setting that allows placing crafted files in the database directory—permissions many properly configured systems already avoid.
Other flaws and what’s at stake
A separate vulnerability, CVE-2026-102523, allows users to read or modify tables beyond their permissions. This arises due to improperly encoded partition names during ALTER TABLE … CONVERT … PARTITION operations. The flaw requires low privileges but benefits from user interaction. Its CVSS rating is 8.0.
Connector/C also has its share of trouble. CVE-2026-107819 affects libmariadb versions 3.4.1 through 3.4.9 and lets an attacker between client and server present a valid certificate for a different host. If successful, the client may end up sending its password in plaintext over that connection—a dangerous privilege escalation, albeit under specific conditions.
The list of affected branches for the CONNECT and .frm vulnerabilities includes MariaDB versions 10.6.1 through 10.6.27; 10.11.1 through 10.11.18; 11.4.1 through 11.4.12; 11.8.1 through 11.8.8; 12.3.1 through 12.3.2; and 13.0.1. Fixes are available in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The partition issue does not affect the 10.6 series.
Mitigation advice
MariaDB administrators are urged to update to patched server versions and upgrade Connector/C to 3.4.10 without delay. While preparing upgrades, it’s wise to remove plugins such as CONNECT if they’re not essential. Review FILE privileges and tighten access to database directories. Turning off partition support can work around the partition-name flaw—but only after verifying any existing tables don’t depend on partitions.
This wave of vulnerabilities underscores how database configurations, file permissions, and unused components continue to magnify risk. As defenders scramble to deploy patches, the broader takeaway is clear: hardening defaults and principle-of-least-privilege remain essential to preventing exploit chains.
Analysis: These vulnerabilities don’t represent sweeping zero-day catastrophes for all MariaDB users—yet for systems exposing specific plugins or permissive file settings, the risk is very real. Security and DBAs should treat this as a wake-up call: conduct audits of server configurations, remove unnecessary modules, and limit file and directory permissions. The real damage will come not from the flaws themselves, but from overlooked setups that make them viable.
