CVE-2026-107818: MariaDB: environment injection via wsrep bootstrap in the mariadb.service file
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 10.6.28 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 10.11.19 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 11.4.13 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 11.8.9 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access as a MariaDB database user with the FILE privilege. The server must also have secure-file-priv configured to allow writes to /run/mysqld.
Is a service restart required for exploitation to take effect?
Yes. The attacker-created /run/mysqld/wsrep-new-cluster file is used by the mariadb.service unit during the next service restart, at which point attacker-controlled environment values can be injected.
Which deployments are affected?
Affected versions begin at 10.6.1 and include releases before 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Systems already running one of those listed fixed versions are not affected by this issue.
What can be done before upgrading?
Restrict FILE privilege to trusted database users and ensure secure-file-priv does not permit writes to /run/mysqld. Check for the presence of /run/mysqld/wsrep-new-cluster before restarting the MariaDB service.