EUVD-2026-36519Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Reachable over the network on the DB port (AV:N/AC:L) but requires an administrative DB account (PR:H); OS command execution as mysqld yields full C/I/A within that host's security scope.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
9DescriptionNVD
Alpine Linux: mariadb fixed in 11.8.8-r0
AnalysisAI
OS command injection in MariaDB Server (CWE-78) affects multiple supported branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.3.x) and allows an attacker with high database privileges to execute arbitrary operating system commands on the database host, leading to full confidentiality, integrity, and availability compromise. The flaw is tracked by Alpine, the upstream MariaDB GHSA-rpgv-q6gv-684r advisory, and MDEV-39648, with patches already released across branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated MariaDB session with high database privileges (CVSS PR:H - typically SUPER, FILE, or equivalent administrative grants), network reachability to the mysqld TCP port (default 3306) from the attacker, and a vulnerable server version in the 10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, or 12.3.1 ranges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are consistent but mixed in urgency: CVSS 3.1 base 7.2 with AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the vulnerability is reachable over the network but only by an account that already holds high privileges on the server, which is a major real-world brake. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained credentials for a highly privileged MariaDB account - for example via credential reuse, a leaked .my.cnf, or insider abuse in a managed/multi-tenant DB platform - connects to the server over the network on port 3306 and issues the vulnerable administrative operation with crafted parameters that smuggle shell metacharacters into the OS command the server builds internally. The injected command executes as the mysqld OS user, giving the attacker a foothold on the database host from which they can read on-disk data files, plant persistence, or pivot. … |
| Remediation | Vendor-released patches are available: upgrade MariaDB Server to 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2 (or later) on the branch you run, per GHSA-rpgv-q6gv-684r and MDEV-39648. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all MariaDB Server instances in your environment, specifically identifying deployments running versions 10.6.x, 10.11.x, 11.4.x, 11.8.x, or 12.3.x. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today