OESA-2026-4595: mariadb security update
MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es):
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bashprofile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.(CVE-2026-107814)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/mariadbto a version that resolves this vulnerability.Fixed in 10.11.19-2.oe2403sp4 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 10.6.28 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 10.11.19 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 11.4.13 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 11.8.9 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 12.3.3 - Upgrade
Upgrade
MariaDBto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
Which installations are affected?
Affected installations use MariaDB RPM packages in the listed vulnerable version ranges, where the mysql service account was created with the database data directory as its home directory. Debian packages are not affected because they set the account home to /nonexistent.
What access does an attacker need?
An attacker needs access as a database user with the FILE privilege. They can use that privilege to write startup files such as .bash_profile into the mysql account's home directory.
When does the malicious startup file execute?
The written startup file can execute when an administrator opens a login shell for the mysql account. Exploitation therefore also relies on an administrator performing that action.
How can I determine whether an installation is exposed?
Check whether MariaDB was installed from an RPM package and whether the mysql service account's home directory is the database data directory rather than /nonexistent. Also determine whether database users have the FILE privilege and whether administrators log in interactively as mysql.
Which versions contain the fix?
The issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.