EUVD-2026-36520Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain DBA credentials
-
DeliveryConnect to MariaDB over network
-
ExploitInvoke vulnerable privileged feature
-
ExecutionInject OS command via unsanitized input
-
PersistExecute shell command as mysql user
-
ImpactPivot to host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated MariaDB session with high database privileges (PR:H - typically SUPER or equivalent DBA rights) against a vulnerable MariaDB Server in the affected version ranges (10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, 12.3.1). No user interaction is required and the network attack vector applies as long as the mysqld port is reachable by the attacker. Limiting factors: deployments that do not expose mysqld off-host, that enforce least-privilege on application accounts, or that already restrict SUPER/FILE/PROCESS privileges substantially shrink the exploitable population; unauthenticated or read-only application users cannot trigger this flaw on their own. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields 7.2 (High), reflecting that exploitation needs high privileges (a DBA-level account) but, once those are held, the impact is total system compromise on the database host. EPSS is only 0.06% (18th percentile) and the vulnerability is not on CISA KEV, which is consistent with an authenticated-only flaw against a server product - real-world risk concentrates on environments where a DBA account is shared, weakly protected, or reachable via a compromised application user. The signals are internally consistent (high CVSS impact, low EPSS, no KEV) rather than conflicting; the main missing datum is a public technical write-up - the GHSA and MDEV tickets are referenced but their detailed content is not provided here, so the exact triggering subsystem is inferred from CWE-78 rather than confirmed. |
| Exploit ScenarioDerived | An attacker who has obtained DBA-level MariaDB credentials - through credential reuse, an exposed backup, or a chained SQL-injection that escalates to a privileged user - connects to the server over the network and abuses the vulnerable subsystem to inject an OS command that runs as the mariadb/mysql service user. From there they pivot from the database process into the host (reading filesystem secrets, writing webshells, or staging lateral movement). No public exploit identified at time of analysis, but the attack complexity is low once credentials are held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jun 16, 2026
Command injection (CWE-78) in MariaDB Server affects multiple branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, and 12.3.x) and allows an authenticated high-privileged user to achieve full compromise of confidentiality, integrity, and availability over the network. Alpine Linux has shipped a fixed package (mariadb 11.8.8-r0), and an upstream advisory (GHSA-7v3p-h23x-8hwv) plus MDEV-39676 track the issue, but no public exploit identified at time of analysis and EPSS is very low at 0.06%.
Earlier versions of this analysis (4)
OS command injection in MariaDB Server (CWE-78) allows a high-privileged database account to execute arbitrary operating-system commands on the host running the database engine. Affected branches are 10.6.x, 10.11.x, 11.4.x, 11.8.x, and 12.3.x prior to the fixed releases, with Alpine Linux shipping the fix as mariadb 11.8.8-r0. No public exploit identified at time of analysis and EPSS is 0.06% (18th percentile), but the impact is full host compromise once the precondition is met.
OS command injection in MariaDB Server (fixed in Alpine Linux package version 11.8.8-r0) allows a high-privileged remote attacker to execute operating system commands with a scope change to other components, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the EPSS score of 0.06% (18th percentile) suggests very low near-term exploitation probability despite the 8.0 CVSS base score. The issue is tracked upstream as GHSA-7v3p-h23x-8hwv / MDEV-39676 and was published as an Alpine vendor advisory.
OS command injection in MariaDB server (CWE-78) on Alpine Linux allows a high-privileged authenticated database user with network access to execute arbitrary operating system commands on the database host, with a scope change extending impact beyond the MariaDB process. The flaw is fixed in the Alpine package mariadb 11.8.8-r0 and tracked upstream as GHSA-7v3p-h23x-8hwv / MDEV-39676. There is no public exploit identified at time of analysis, EPSS is very low (0.06%, 18th percentile), and the issue is not on the CISA KEV list.
MariaDB on Alpine Linux contains a vulnerability addressed in Alpine package version 11.8.8-r0. The nature of the flaw - including affected component, attack vector, and potential impact - is not described in available intelligence sources. No public exploit has been identified at time of analysis, and no KEV listing exists. Security teams should treat this as a vendor-confirmed fix requiring patch application until fuller CVE details are published.
RemediationAI
Upgrade MariaDB Server to a fixed release on your branch: 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2 or later, per upstream advisory GHSA-7v3p-h23x-8hwv (https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv) and tracker MDEV-39676 (https://jira.mariadb.org/browse/MDEV-39676); on Alpine Linux, apk upgrade to mariadb 11.8.8-r0 or newer (Vendor-released patch: 11.8.8-r0 on Alpine, 11.8.8/12.3.2/11.4.12/10.11.18/10.6.27 upstream). Until patched, restrict the privileged account class that this CVE requires - revoke SUPER/PROCESS/FILE and any privilege that allows loading plugins or modifying system variables that resolve to OS paths, and audit which users actually need DBA-level rights (trade-off: legitimate automation that relies on those privileges will need reworking). Also bind mysqld to a management network or local socket and front it with strict firewalling so the network-reachable attack surface for a stolen DBA credential is minimized (trade-off: remote DBA tooling and replication must use that controlled path).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MariaDB is a widely deployed open-source relational database forked from MySQL, used both as a standalone DBMS and embedded in countless application stacks. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that some server-side code path passes attacker-influenced input into an OS shell or process invocation without sufficient sanitization - typically via a feature reachable only by a privileged database account (for example, a UDF/plugin load path, a system-variable that resolves to a shell command, or a maintenance/utility subsystem). CPE data confirms the mariadb:mariadb product line including the 12.3.1 release, and the EUVD-listed branches (10.6, 10.11, 11.4, 11.8, 12.3) align with MariaDB's current LTS and rolling-release tree.
Know when MariaDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable mysqld (AV:N), no special timing (AC:L), requires high DBA privilege to reach the vulnerable command path (PR:H), no user interaction, and OS command execution as the service user yields full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Alpine Linux: mariadb fixed in 11.8.8-r0
Executive ViewAI
MariaDB Server (versions 10.6 through 12.3) contains a command injection vulnerability that could permit privileged database users to achieve full database compromise. While current exploitation risk is minimal (0.1% EPSS) with no public exploit identified at time of analysis, the broad version range affected and potential for insider threats warrant prompt patching to protect organizational data integrity and availability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
Exploit-DB