Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-3494

MariaDB Server Audit Plugin Comment Handling Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
AMZN

Description

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MariaDB Foundation MariaDB Server

Default version status: unaffected

  • 0 to < 10.6.25affected
  • 0 to < 10.11.16affected
  • 0 to < 11.4.10affected
  • 0 to < 11.8.6affected

Amazon Aurora MySQL

Default version status: unaffected

  • 0 to < 2.12.6affected
  • 0 to < 3.04.6affected
  • 0 to < 3.10.3affected
  • 0 to < 3.11.1affected

Amazon RDS for MySQL

Default version status: unaffected

  • 0 to < 5.7.44-RDS.20260212affected
  • 0 to < 8.0.45affected
  • 0 to < 8.4.8affected

Amazon RDS for MariaDB

Default version status: unaffected

  • 0 to < 10.6.25affected
  • 0 to < 10.11.16affected
  • 0 to < 11.4.10affected
  • 0 to < 11.8.6affected

References