EUVD-2026-36520Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable mysqld (AV:N), no special timing (AC:L), requires high DBA privilege to reach the vulnerable command path (PR:H), no user interaction, and OS command execution as the service user yields full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
9DescriptionNVD
Alpine Linux: mariadb fixed in 11.8.8-r0
AnalysisAI
Command injection (CWE-78) in MariaDB Server affects multiple branches (10.6.x, 10.11.x, 11.4.x, 11.8.x, and 12.3.x) and allows an authenticated high-privileged user to achieve full compromise of confidentiality, integrity, and availability over the network. Alpine Linux has shipped a fixed package (mariadb 11.8.8-r0), and an upstream advisory (GHSA-7v3p-h23x-8hwv) plus MDEV-39676 track the issue, but no public exploit identified at time of analysis and EPSS is very low at 0.06%.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated MariaDB session with high database privileges (PR:H - typically SUPER or equivalent DBA rights) against a vulnerable MariaDB Server in the affected version ranges (10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, 12.3.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields 7.2 (High), reflecting that exploitation needs high privileges (a DBA-level account) but, once those are held, the impact is total system compromise on the database host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained DBA-level MariaDB credentials - through credential reuse, an exposed backup, or a chained SQL-injection that escalates to a privileged user - connects to the server over the network and abuses the vulnerable subsystem to inject an OS command that runs as the mariadb/mysql service user. From there they pivot from the database process into the host (reading filesystem secrets, writing webshells, or staging lateral movement). … |
| Remediation | Upgrade MariaDB Server to a fixed release on your branch: 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2 or later, per upstream advisory GHSA-7v3p-h23x-8hwv (https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv) and tracker MDEV-39676 (https://jira.mariadb.org/browse/MDEV-39676); on Alpine Linux, apk upgrade to mariadb 11.8.8-r0 or newer (Vendor-released patch: 11.8.8-r0 on Alpine, 11.8.8/12.3.2/11.4.12/10.11.18/10.6.27 upstream). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all MariaDB deployments and current versions across infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today