EUVD-2026-36519Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege DB credentials
-
DeliveryConnect to mysqld over TCP/3306
-
ExploitIssue admin operation with shell metacharacters
-
ExecutionServer builds OS command from tainted input
-
PersistShell executes as mysqld OS user
-
ImpactRead data files and pivot on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated MariaDB session with high database privileges (CVSS PR:H - typically SUPER, FILE, or equivalent administrative grants), network reachability to the mysqld TCP port (default 3306) from the attacker, and a vulnerable server version in the 10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, or 12.3.1 ranges. No user interaction or victim click is required (UI:N), and the bug does not depend on a non-default configuration flag being toggled on, but it is inherently limited to actors who already hold administrative credentials - pure unauthenticated remote attackers cannot trigger it, which is the principal limiter on real-world risk. |
| Impact | Signals are consistent but mixed in urgency: CVSS 3.1 base 7.2 with AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the vulnerability is reachable over the network but only by an account that already holds high privileges on the server, which is a major real-world brake. SSVC-style framing therefore puts technical impact as Total but automatable likely No (requires authenticated high-privilege session), and exploitation status as None observed. EPSS at 0.07% (22nd percentile) and absence from CISA KEV align with that view, and no public POC is referenced. The practical priority is high for any deployment where untrusted or semi-trusted DBAs/operators exist (managed DB services, multi-tenant clusters, shared hosting), and standard for fully internal single-tenant databases, but every operator should still apply the fix because privilege escalation from DBA to OS code execution breaks a key trust boundary defenders typically rely on. |
| Exploit ScenarioDerived | An attacker who has obtained credentials for a highly privileged MariaDB account - for example via credential reuse, a leaked .my.cnf, or insider abuse in a managed/multi-tenant DB platform - connects to the server over the network on port 3306 and issues the vulnerable administrative operation with crafted parameters that smuggle shell metacharacters into the OS command the server builds internally. The injected command executes as the mysqld OS user, giving the attacker a foothold on the database host from which they can read on-disk data files, plant persistence, or pivot. No public POC is referenced, but the attack complexity is low once the privileged session is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jun 16, 2026
OS command injection in MariaDB Server (CWE-78) affects multiple supported branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, 12.3.x) and allows an attacker with high database privileges to execute arbitrary operating system commands on the database host, leading to full confidentiality, integrity, and availability compromise. The flaw is tracked by Alpine, the upstream MariaDB GHSA-rpgv-q6gv-684r advisory, and MDEV-39648, with patches already released across branches. No public exploit is identified at time of analysis and EPSS is very low (0.07%, 22th percentile), so the issue is currently treated as a high-severity patch-now rather than an in-the-wild emergency.
Earlier versions of this analysis (4)
OS command injection in MariaDB Server (CWE-78) allows an authenticated high-privileged database user to execute arbitrary operating system commands on the database host, resulting in full compromise of confidentiality, integrity, and availability. The flaw affects multiple supported MariaDB branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, and 12.3.x) up to the listed fix versions, and Alpine Linux has shipped a fixed package at mariadb 11.8.8-r0. No public exploit identified at time of analysis, and EPSS is low (0.07%, 22nd percentile), but the CVSS base score of 7.2 reflects high impact once the prerequisite privilege is obtained.
OS command injection in MariaDB (CWE-78) allows a highly privileged database user to escape the database engine and execute arbitrary operating system commands on the host, per the MariaDB security advisory GHSA-rpgv-q6gv-684r and bug MDEV-39648. The flaw affects MariaDB packaging on Alpine Linux prior to 11.8.8-r0 and carries a scope-changed CVSS 3.1 score of 8.0, but currently shows no public exploit identified at time of analysis and a low EPSS of 0.07%.
Command injection in MariaDB (fixed in Alpine Linux package 11.8.8-r0) allows a high-privileged remote actor to execute arbitrary OS commands on the database host, with confidentiality, integrity, and availability all rated High. The flaw is tracked upstream as GHSA-rpgv-q6gv-684r / MDEV-39648 and currently has no public exploit identified at time of analysis, with EPSS placing exploitation probability at only 0.07%.
MariaDB on Alpine Linux received a security fix packaged as version 11.8.8-r0 in the Alpine repository, addressing CVE-2026-48163. The underlying vulnerability details - including attack vector, impact class, and affected component - have not been publicly disclosed in the available intelligence at time of analysis. No CVSS score, CWE classification, or vendor advisory beyond the Alpine package changelog has been identified, making authoritative impact assessment impossible without additional disclosure.
RemediationAI
Vendor-released patches are available: upgrade MariaDB Server to 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2 (or later) on the branch you run, per GHSA-rpgv-q6gv-684r and MDEV-39648. Alpine users should move the mariadb package to 11.8.8-r0 or newer via apk upgrade. Until patched, reduce blast radius by treating SUPER/admin-class privileges as production secrets: audit and minimize accounts holding global administrative grants, remove unused high-privilege users, and ensure the mysqld process runs as the dedicated unprivileged mysql OS user (not root) so command execution is contained to that account - note this does not block the bug, only limits OS-level impact. Restrict TCP/3306 to known application hosts via firewall or bind-address to prevent remote login attempts from compromised credentials, and enable audit logging (server_audit plugin) so any post-exploitation activity is recoverable; the trade-off is added log volume and a small performance hit. Do not rely on these compensations as a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MariaDB is an open-source relational database forked from MySQL and shipped by major Linux distributions including Alpine. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that some server-side code path constructs a shell or process invocation from input that an authorized database operator can influence, allowing arguments or commands to be injected into the underlying OS. Affected CPEs are all cpe:2.3:a:mariadb:mariadb, with version 12.3.1 explicitly enumerated, and EUVD lists fixes across the LTS (10.6, 10.11, 11.4) and current (11.8, 12.3) trains, which strongly suggests the vulnerable code sits in a long-lived server feature rather than a new component. The MDEV-39648 Jira issue is the upstream tracking ticket and GHSA-rpgv-q6gv-684r is the coordinated security advisory describing the fix.
Know when MariaDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Reachable over the network on the DB port (AV:N/AC:L) but requires an administrative DB account (PR:H); OS command execution as mysqld yields full C/I/A within that host's security scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Alpine Linux: mariadb fixed in 11.8.8-r0
Executive ViewAI
MariaDB Server versions 10.6 through 12.3 contain an OS command injection vulnerability accessible to database accounts with elevated privileges, allowing execution of arbitrary operating system commands on database hosts. Successful exploitation results in complete compromise of the database infrastructure and connected systems, including loss of all confidentiality, integrity, and availability protections. Organizations running these versions should prioritize patching to prevent insider threats and lateral movement attacks originating from compromised database accounts.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
Exploit-DB