MariaDB Server CVE-2026-85985

Exploitation requires the optional CONNECT storage engine plugin (ha_connect) to be installed and loaded - it is not enabled in default MariaDB installations - and the attacker must possess a valid low-privileged database account able to execute the CONNECT file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), or jbin_file(). The attacker does NOT need the FILE privilege and is not constrained by secure_file_priv, which is precisely the missing enforcement. Realistic impact is limited by the operating-system file permissions of the database service account (typically the 'mysql' user), so only files that account can read or write are reachable; no end-user interaction is required.

This is a genuine but moderate-priority authorization flaw (CWE-862), not a high-urgency emergency. The vendor CVSS of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) is internally consistent with the description: a network-reachable, low-complexity issue that requires an existing low-privileged database account (PR:L) and yields only partial confidentiality and integrity impact (C:L/I:L) because file access is still bounded by operating-system permissions of the database service account, with no availability impact (A:N). No EPSS score, KEV listing, or public POC was provided, so there is no signal of active or probable near-term exploitation - the absence of these should be read as 'not present in the supplied data' rather than confirmed-safe. The practical risk is further gated by a prerequisite the raw CVSS vector does not capture: the CONNECT storage engine plugin is an optional, non-default component, so most MariaDB deployments are not exposed at all. The source-code diff confirms the root cause and fix (a new connect_can_access_file() helper enforcing FILE_ACL and is_secure_file_path()), which raises confidence that the vulnerability and its remediation are real. Net: a real defense-in-depth gap worth patching on CONNECT-enabled servers, but not a drop-everything issue given PR:L, partial impact, OS-permission limits, and no exploitation evidence.

An attacker who already holds a low-privileged MariaDB account on a server where the CONNECT engine is loaded calls a CONNECT file-access UDF such as json_file() or jfile_make() with an arbitrary filesystem path. Because FILE privilege and secure_file_priv are not enforced, they read sensitive files (e.g., configuration or credential files) or write files anywhere the database service account's OS permissions allow, bypassing the intended database-level authorization. No public exploit code was identified at time of analysis.