EUVD-2026-36520Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable mysqld (AV:N), no special timing (AC:L), requires high DBA privilege to reach the vulnerable command path (PR:H), no user interaction, and OS command execution as the service user yields full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
9DescriptionNVD
Alpine Linux: mariadb fixed in 11.8.8-r0
AnalysisAI
Command injection (CWE-78) in MariaDB Server affects multiple branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, and 12.3.x) and allows an authenticated high-privileged user to achieve full compromise of confidentiality, integrity, and availability over the network. Alpine Linux has shipped a fixed package (mariadb 11.8.8-r0), and an upstream advisory (GHSA-7v3p-h23x-8hwv) plus MDEV-39676 track the issue, but no public exploit identified at time of analysis and EPSS is very low at 0.06%.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated MariaDB session with high database privileges (PR:H - typically SUPER or equivalent DBA rights) against a vulnerable MariaDB Server in the affected version ranges (10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, 12.3.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields 7.2 (High), reflecting that exploitation needs high privileges (a DBA-level account) but, once those are held, the impact is total system compromise on the database host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained DBA-level MariaDB credentials - through credential reuse, an exposed backup, or a chained SQL-injection that escalates to a privileged user - connects to the server over the network and abuses the vulnerable subsystem to inject an OS command that runs as the mariadb/mysql service user. From there they pivot from the database process into the host (reading filesystem secrets, writing webshells, or staging lateral movement). … |
| Remediation | Upgrade MariaDB Server to a fixed release on your branch: 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2 or later, per upstream advisory GHSA-7v3p-h23x-8hwv (https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv) and tracker MDEV-39676 (https://jira.mariadb.org/browse/MDEV-39676); on Alpine Linux, apk upgrade to mariadb 11.8.8-r0 or newer (Vendor-released patch: 11.8.8-r0 on Alpine, 11.8.8/12.3.2/11.4.12/10.11.18/10.6.27 upstream). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all MariaDB deployments and current versions across infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today