EUVD-2026-36519Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Reachable over the network on the DB port (AV:N/AC:L) but requires an administrative DB account (PR:H); OS command execution as mysqld yields full C/I/A within that host's security scope.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
9DescriptionNVD
Alpine Linux: mariadb fixed in 11.8.8-r0
AnalysisAI
OS command injection in MariaDB Server (CWE-78) affects multiple supported branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.3.x) and allows an attacker with high database privileges to execute arbitrary operating system commands on the database host, leading to full confidentiality, integrity, and availability compromise. The flaw is tracked by Alpine, the upstream MariaDB GHSA-rpgv-q6gv-684r advisory, and MDEV-39648, with patches already released across branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated MariaDB session with high database privileges (CVSS PR:H - typically SUPER, FILE, or equivalent administrative grants), network reachability to the mysqld TCP port (default 3306) from the attacker, and a vulnerable server version in the 10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, or 12.3.1 ranges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are consistent but mixed in urgency: CVSS 3.1 base 7.2 with AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the vulnerability is reachable over the network but only by an account that already holds high privileges on the server, which is a major real-world brake. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained credentials for a highly privileged MariaDB account - for example via credential reuse, a leaked .my.cnf, or insider abuse in a managed/multi-tenant DB platform - connects to the server over the network on port 3306 and issues the vulnerable administrative operation with crafted parameters that smuggle shell metacharacters into the OS command the server builds internally. The injected command executes as the mysqld OS user, giving the attacker a foothold on the database host from which they can read on-disk data files, plant persistence, or pivot. … |
| Remediation | Vendor-released patches are available: upgrade MariaDB Server to 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2 (or later) on the branch you run, per GHSA-rpgv-q6gv-684r and MDEV-39648. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all MariaDB Server instances in your environment, specifically identifying deployments running versions 10.6.x, 10.11.x, 11.4.x, 11.8.x, or 12.3.x. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today