CVE-2026-3494: MariaDB Server Audit Plugin Comment Handling Bypass
In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL, QUERYDDL, or QUERYDML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
Other sources
MariaDB Server Audit Plugin Comment Handling Bypass
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Do not rely on the MariaDB server audit plugin to log statements when COMMENT styles prefixed with double-hyphen (—) or hash (#) are used; adjust auditing strategy accordingly.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3494?
CVE-2026-3494 is rated as a medium severity vulnerability due to its potential for authenticated users to bypass auditing mechanisms.
How do I fix CVE-2026-3494?
To fix CVE-2026-3494, you should upgrade to a version of MariaDB Server later than 11.8.5 to ensure audit plugin protections are properly enforced.
Who is affected by CVE-2026-3494?
CVE-2026-3494 affects users of MariaDB Server versions up to and including 11.8.5 with the audit plugin enabled.
What impact does CVE-2026-3494 have on database security?
CVE-2026-3494 could allow malicious users to execute certain SQL statements without triggering audit logs, undermining database security.
Is there a workaround for CVE-2026-3494?
Currently, disabling the server audit plugin is a temporary workaround for mitigating CVE-2026-3494 until a software update can be applied.