CVE-2026-3494: MariaDB Server Audit Plugin Comment Handling Bypass
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3494?
CVE-2026-3494 is rated as a medium severity vulnerability due to its potential for authenticated users to bypass auditing mechanisms.
How do I fix CVE-2026-3494?
To fix CVE-2026-3494, you should upgrade to a version of MariaDB Server later than 11.8.5 to ensure audit plugin protections are properly enforced.
Who is affected by CVE-2026-3494?
CVE-2026-3494 affects users of MariaDB Server versions up to and including 11.8.5 with the audit plugin enabled.
What impact does CVE-2026-3494 have on database security?
CVE-2026-3494 could allow malicious users to execute certain SQL statements without triggering audit logs, undermining database security.
Is there a workaround for CVE-2026-3494?
Currently, disabling the server audit plugin is a temporary workaround for mitigating CVE-2026-3494 until a software update can be applied.