MariaDB Server up to 10.6.24/10.11.15/11.4.9/11.8.5 server_audit_events insufficient logging

Summaryinfo

A vulnerability identified as problematic has been detected in MariaDB Server up to 10.6.24/10.11.15/11.4.9/11.8.5. Impacted is an unknown function. This manipulation of the argument server_audit_events causes insufficient logging. This vulnerability is registered as CVE-2026-3494. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in MariaDB Server up to 10.6.24/10.11.15/11.4.9/11.8.5. It has been declared as problematic. Affected by this vulnerability is some unknown functionality. The manipulation of the argument server_audit_events with an unknown input leads to a insufficient logging vulnerability. The CWE definition for the vulnerability is CWE-778. When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it. As an impact it is known to affect integrity. The summary by CVE is:

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

It is possible to read the advisory at aws.amazon.com. This vulnerability is known as CVE-2026-3494 since 03/03/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1562.002 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 300814 (Linux Distros Unpatched Vulnerability : CVE-2026-3494), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 10.6.25, 10.11.16, 11.4.10 or 11.8.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (300814). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• MariaDB

Name

• Server

Version

• 10.6.0
• 10.6.1
• 10.6.2
• 10.6.3
• 10.6.4
• 10.6.5
• 10.6.6
• 10.6.7
• 10.6.8
• 10.6.9
• 10.6.10
• 10.6.11
• 10.6.12
• 10.6.13
• 10.6.14
• 10.6.15
• 10.6.16
• 10.6.17
• 10.6.18
• 10.6.19
• 10.6.20
• 10.6.21
• 10.6.22
• 10.6.23
• 10.6.24
• 10.11.0
• 10.11.1
• 10.11.2
• 10.11.3
• 10.11.4
• 10.11.5
• 10.11.6
• 10.11.7
• 10.11.8
• 10.11.9
• 10.11.10
• 10.11.11
• 10.11.12
• 10.11.13
• 10.11.14
• 10.11.15
• 11.4.0
• 11.4.1
• 11.4.2
• 11.4.3
• 11.4.4
• 11.4.5
• 11.4.6
• 11.4.7
• 11.4.8
• 11.4.9
• 11.8.0
• 11.8.1
• 11.8.2
• 11.8.3
• 11.8.4
• 11.8.5

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion