EUVD-2026-36514Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged MariaDB credentials
-
DeliveryReach mariadbd on TCP/3306
-
ExploitSubmit crafted SQL invoking vulnerable path
-
ExecutionInject shell metacharacters into OS command
-
PersistExecute code as mysql service account
-
ImpactPivot to host filesystem and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already possess a high-privileged MariaDB account (CVSS PR:H - e.g., an admin or DBA login with elevated grants), and must reach the MariaDB network endpoint (typically TCP/3306) from a location permitted by bind-address, firewall, and host-based access controls. AC:H signals a non-trivial precondition - likely a specific server configuration, feature being enabled, or a race/timing dependency - that the publicly available Alpine description does not enumerate; the linked MariaDB GHSA-vwf7-w26c-9w5h should be consulted for the exact feature/configuration trigger. UI:N means no victim interaction is required once the attacker has the credential and network path. Limiting factors: unauthenticated or low-privileged users cannot reach the vulnerable path, and deployments that already gate the DB port behind a bastion/private network significantly shrink the exposed surface. |
| Impact | Signals are mixed and point to a serious-but-narrow problem rather than a mass-exploitation event. CVSS base of 8.0 is high, but its components moderate the real-world urgency: AV:N is offset by AC:H (a non-trivial precondition or race) and PR:H (an already-privileged DB account), meaning the attacker must already have substantial access. EPSS at 0.07% (22nd percentile) is very low, the CVE is not on CISA KEV, and no public POC is referenced - consistent with a freshly disclosed, vendor-tracked issue without weaponized tooling. The Alpine vendor advisory and upstream MariaDB GHSA confirm the vulnerability is real and patched, so this is a credible priority for environments that expose privileged DB accounts to less-trusted operators (multi-tenant DBaaS, shared admin tooling), but a lower priority for single-tenant deployments where only trusted admins hold high-privilege accounts. Note also that the Alpine-supplied description is sparse - the precise injectable feature is not stated and would need to be confirmed against the linked GHSA. |
| Exploit ScenarioDerived | An attacker who already holds (or has compromised) a high-privileged MariaDB account connects to the server over the network and issues a crafted sequence that triggers the vulnerable code path, smuggling shell metacharacters into an OS command the server executes internally. Because the CVSS scope is changed, the injected command runs in the host OS context as the mariadbd service account, giving the attacker file read/write and code execution on the database host beyond the SQL boundary. No public POC is referenced, so any near-term exploitation would likely be hand-crafted from the GHSA writeup rather than off-the-shelf. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 12, 2026
OS command injection in MariaDB Server (fixed in Alpine package mariadb 11.8.7-r0) allows a high-privileged authenticated database user to break the trust boundary between SQL and the underlying operating system, resulting in confidentiality, integrity, and availability impact across components (scope changed). No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.07%, 22nd percentile). Tracked upstream as MariaDB MDEV-39413 with security advisory GHSA-vwf7-w26c-9w5h.
Earlier versions of this analysis (2)
OS command injection (CWE-78) in MariaDB server, tracked by upstream advisory GHSA-vwf7-w26c-9w5h and issue MDEV-39413, allows a high-privileged authenticated attacker to break out of intended SQL boundaries and execute commands with scope change to other components. The flaw is reported via Alpine Linux, which ships a fixed package as mariadb 11.8.7-r0, and no public exploit identified at time of analysis. EPSS probability is very low (0.07%, 22nd percentile), consistent with the CVSS AC:H/PR:H prerequisites.
MariaDB on Alpine Linux has been patched in package version 11.8.7-r0, addressing an unspecified vulnerability. The nature of the flaw - including its attack vector, impact, and affected component - is not disclosed in the available intelligence. The sole confirmed data point is that Alpine Linux issued a package update, suggesting the upstream MariaDB 11.8.x branch contained a security defect requiring remediation. No CVSS score, CWE classification, or exploit information is available to characterize severity or exploitability.
RemediationAI
Vendor-released patch: Alpine mariadb 11.8.7-r0 - upgrade the Alpine package via apk to that version or later. For non-Alpine deployments consult the upstream advisory at https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h and the tracking ticket https://jira.mariadb.org/browse/MDEV-39413 to identify the corresponding upstream fixed release. Until patching, reduce risk by restricting which accounts hold high-privilege grants (revoke SUPER, FILE, PROCESS, and global administrative privileges from non-essential users), avoid sharing privileged accounts across tenants or applications, and run mariadbd under a dedicated low-privileged OS user with AppArmor/SELinux confinement so a successful command injection lands in a constrained sandbox rather than as root - note that tightening grants may break legitimate admin tooling or replication users and should be tested in staging first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MariaDB is a widely deployed open-source relational database server forked from MySQL. The flaw is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning a server-side code path constructs and executes an operating-system command using attacker-influenced input without proper sanitization or argument separation. The CVSS scope-changed flag (S:C) indicates the injected command escapes the database engine's security context, executing in the host operating system context with whatever privileges the mysqld/mariadbd process holds - typically the dedicated 'mysql' user on Alpine-packaged installations. The referenced GitHub Security Advisory (GHSA-vwf7-w26c-9w5h) and Jira ticket MDEV-39413 are the authoritative upstream tracking items for the issue.
Know when MariaDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable DB service (AV:N), needs high-privileged account (PR:H) and a non-trivial trigger condition (AC:H); OS command execution escapes the DB engine (S:C) with full host CIA impact.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
4DescriptionCVE.org
Alpine Linux: mariadb fixed in 11.8.7-r0
Executive ViewAI
A command injection flaw in MariaDB Server allows database administrators to break security boundaries and execute arbitrary operating system commands, directly threatening data confidentiality and system availability. Organizations depend on database administrators to protect sensitive data, making this vulnerability significant for environments where privileged accounts face insider risk or compromise. No active exploitation has been documented, but the attack surface within administrative environments requires immediate mitigation.
Vendor-released patch: mariadb 11.8.7-r0. Interim mitigations: restrict database administrative privileges to minimum necessary personnel, implement multi-factor authentication for admin access, enable audit logging of all administrative commands, monitor administrative accounts for anomalous activity, restrict network access to database administration tools.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
Exploit-DB