Threat reportVulnerabilityTL-2026-3391
MariaDB Server and Connector/C Flaws Enable Code Execution, Data Access and Credential Exposure (CVE-2026-107815, CVE-2026-107821, CVE-2026-102523, CVE-2026-107819)
MariaDB Server and Connector/C Flaws Enable Code Execution (TL-2026-3391) is a high-severity software vulnerability scored CVSS 8.5, first published 2026-10-13. It has no confirmed attribution, affects MariaDB MariaDB Server (CONNECT engine, binary .frm handling), references 10 CVEs (CVE-2026-107815, CVE-2026-107821, CVE-2026-102523), maps to 12 MITRE ATT&CK techniques (T1005, T1040, T1059), and is covered by 9 detection rules and 18 indicators of compromise.
- CVSS
- 8.5/10High
- CVEs
- 10Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-3391
- Threat ID
- TL-2026-3391
- Severity
- HIGH
- CVSS
- 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, finance, health, government administration, ecommerce
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
- Updates
- 2026-10-13 · revalidated 1× · latest source
How MariaDB Server and Connector/C Flaws Enable Code Execution works
Four MariaDB flaws were fixed in the October 2026 releases: a CONNECT-engine stack out-of-bounds write (CVSS 8.5), crafted binary .frm file handling (8.0), unsafe partition-name encoding (8.0) and a Connector/C hostname-verification flaw that can expose passwords to a man-in-the-middle (5.9). Remote code execution was shown only under laboratory conditions and no in-the-wild exploitation is reported.
CVE-2026-107815 (CWE-787, CVSS 3.1 8.5, vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) affects the CONNECT storage engine's DOS table type. An incorrect boundary check permits a one-byte NULL write beyond a stack buffer at an attacker-specified offset. The GitHub advisory (GHSA-4wgx-ffg9-jrwq, credited to HackerOne reporter dstesk) states this 'was demonstrated to cause a remote code execution in the lab conditions'. An authenticated user permitted to use the CONNECT engine can crash the server (denial of service) and potentially achieve code execution. Affected: MariaDB 10.6.1-10.6.27, 10.11.1-10.11.18, 11.4.1-11.4.12, 11.8.1-11.8.8, 12.3.1-12.3.2 and 13.0.1 (the secondary article lists 10.11.1-10.11.19, which conflicts with the advisory and the 10.11.19 fix). Tracked as MDEV-40637; fix commit b369925f6855d3e1f0ebcf453492724b99fda6f8. The advisory's mitigation is to uninstall the CONNECT plugin when it is not needed.
CVE-2026-107821 (CWE-1285, CVSS 3.1 8.0, vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H; GHSA-c4gx-34mg-95q5, credited to pinebudweiser and Ph4nt0m) is caused by insufficient validation of counts, offsets, lengths and field boundaries in FRM metadata when MariaDB parses binary .frm files. An attacker able to place a crafted .frm file in the data directory can trigger out-of-bounds reads or writes, crash the server, or potentially execute code. Exploitation needs the FILE privilege together with a secure-file-priv setting that permits writing into the database directory; correctly configured servers block this. Tracked as MDEV-40571; fix commit 3b1c2e58abab5571bec4ff52773ddc75b1738da9. Same affected ranges as CVE-2026-107815.
CVE-2026-102523 (CWE-73, CVSS 3.1 8.0, vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H; GHSA-h4vr-wpff-jfx4) concerns improper encoding of partition names for the filesystem during ALTER TABLE ... CONVERT ... PARTITION, letting a low-privileged user (with some user interaction) read or modify tables beyond their assigned permissions. Affected: 10.11.1-10.11.18, 11.4.1-11.4.12, 11.8.1-11.8.8, 12.3.1-12.3.2 and 13.0.1; the 10.6 branch is not affected. Credits: Ben Bidner (Automattic Security Team) as discoverer and vortfu as reporter. Advisory remediation option: start the server with --skip-plugin-partition to disable partition support.
CVE-2026-107819 (CWE-297, CVSS 3.1 5.9, vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) affects MariaDB Connector/C (libmariadb) 3.4.1-3.4.9. A programming mistake in SSL authentication logic lets an active man-in-the-middle holding a valid certificate for a different hostname bypass hostname verification, request cleartext password authentication and capture the client's password. The Hacker Wire entry lists the range as through 3.4.10, which conflicts with 3.4.10 being the fixed release. Other MariaDB connectors are unaffected. Tracked as CONC-846 / GHSA-fmq9-qjxj-qpf7 (the GitHub advisory page could not be retrieved); fix commit e8c0a16d94ddf844668d684a7d42b37ac8e0fc02.
All issues were fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 (server) and Connector/C 3.4.10. The three server GHSA pages show a publication date of 2026-09-07, while CVE aggregators and the media report date publication to 2026-10-09 and 2026-10-13; this record uses the earliest dated primary source. The vendor reports no confirmed attacks against live systems and no public PoC or IOCs were identified. Debian Bookworm and Trixie were still listed as vulnerable (1:10.11.18 and 1:11.8.6) at the time of the tracker snapshot.
MITRE ATT&CK techniques used in TL-2026-3391
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Credential Access
T1040 Network Sniffing; T1557 Adversary-in-the-Middle
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Impact
T1499 Endpoint Denial of Service; T1565.001 Stored Data Manipulation
Persistence
T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
Affected products and versions in MariaDB Server and Connector/C Flaws Enable Code Execution
- MariaDB — MariaDB Server (CONNECT engine, binary .frm handling)
Vulnerable versions: 10.6.1-10.6.27; 10.11.1-10.11.18; 11.4.1-11.4.12; 11.8.1-11.8.8; 12.3.1-12.3.2; 13.0.1
Fixed in: 10.6.28; 10.11.19; 11.4.13; 11.8.9; 12.3.3; 13.0.2 - MariaDB — MariaDB Server (partition handling, CVE-2026-102523; 10.6 branch not affected)
Vulnerable versions: 10.11.1-10.11.18; 11.4.1-11.4.12; 11.8.1-11.8.8; 12.3.1-12.3.2; 13.0.1
Fixed in: 10.11.19; 11.4.13; 11.8.9; 12.3.3; 13.0.2 - MariaDB — MariaDB Connector/C (libmariadb)
Vulnerable versions: 3.4.1-3.4.9
Fixed in: 3.4.10
Remediation for MariaDB Server and Connector/C Flaws Enable Code Execution
Patches
- MariaDB Server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2
- MariaDB Connector/C 3.4.10
- Distribution packages (Debian Forky/Sid carry 1:11.8.9; Bookworm and Trixie were still vulnerable at snapshot time)
Immediate actions
- Upgrade MariaDB Server to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 or 13.0.2
- Upgrade MariaDB Connector/C (libmariadb) to 3.4.10 and rebuild or redeploy dependent client applications
- Remove or disable the CONNECT storage engine plugin where it is not required
Workarounds
- UNINSTALL SONAME 'ha_connect' / remove the CONNECT plugin to neutralise CVE-2026-107815
- Deny FILE privilege and restrict secure-file-priv to mitigate CVE-2026-107821
- Start mariadbd with --skip-plugin-partition to mitigate CVE-2026-102523 if partitioning is unused
Longer-term hardening
- Audit and minimise the FILE privilege and set secure-file-priv to a directory outside the data directory
- Restrict users who can run ALTER TABLE ... CONVERT ... PARTITION and disable partitioning if unused
- Enforce TLS with full certificate and hostname verification between clients and servers
- Monitor mariadbd for unexpected crashes and for .frm files created outside normal DDL activity
CVEs associated with MariaDB Server and Connector/C Flaws Enable Code Execution
CVE-2026-107815, CVE-2026-107821, CVE-2026-102523, CVE-2026-107819, CVE-2026-107814, CVE-2026-107818, CVE-2026-107817, CVE-2026-107816, CVE-2026-107822, CVE-2026-107823
Weaknesses (CWE) in MariaDB Server and Connector/C Flaws Enable Code Execution
CWE-787, CWE-1285, CWE-73, CWE-297, CWE-732, CWE-427, CWE-15
Timeline of MariaDB Server and Connector/C Flaws Enable Code Execution
- GitHub security advisories GHSA-4wgx-ffg9-jrwq (CVE-2026-107815), GHSA-c4gx-34mg-95q5 (CVE-2026-107821) and GHSA-h4vr-wpff-jfx4 (CVE-2026-102523) show a publication date of 2026-09-07; credits go to dstesk, pinebudweiser/Ph4nt0m and Ben Bidner/vortfu respectively.
- Vulnerabilities reported/disclosed to MariaDB roughly three days before CVE publication (per CVE record metadata).
- CVE-2026-107814 (RPM mysql account home set to the datadir) and CVE-2026-107818 (wsrep-new-cluster environment injection), both CVSS 8.4 with FILE-privilege prerequisites, published as part of the same ten-CVE MariaDB batch.
- Debian tracker lists Forky/Sid fixed in 1:11.8.9 while Bookworm (1:10.11.18) and Trixie (1:11.8.6) remained vulnerable.
- MariaDB Server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 released with fixes; Connector/C 3.4.10 fixes the hostname-verification flaw.
- CVE-2026-107815, CVE-2026-107821 and CVE-2026-107819 published in CVE aggregators; fix commits made public.
- GBHackers summarises the full ten-CVE MariaDB batch; no active exploitation, public PoC or attribution reported.
- Cyber Security News publishes coverage; RCE described as demonstrated only in laboratory conditions with no confirmed attacks against live systems.
Update history for TL-2026-3391
- 2026-10-13 — MariaDB Server and Connector/C Vulnerabilities Enable Remote Code Execution and Privilege Escalation (CVE-2026-107815, CVE-2026-107821, CVE-2026-107814, CVE-2026-107818): What changed No field escalation: severity (HIGH), CVSS (8.5), exploitability (THEORETICAL) and status (PATCHED) unchanged. The scope of the published batch is wider than the existing record: six additional CVEs, three additional CWEs. New
Sources cited for MariaDB Server and Connector/C Flaws Enable Code Execution
- Critical MariaDB Flaws Can Let Attackers Execute Code and Steal Database Data
- GHSA-4wgx-ffg9-jrwq - MariaDB CONNECT engine DOS table out-of-bounds write (CVE-2026-107815)
- GHSA-c4gx-34mg-95q5 - MariaDB binary FRM validation (CVE-2026-107821)
- GHSA-h4vr-wpff-jfx4 - MariaDB partition name encoding (CVE-2026-102523)
- CVE-2026-107815 - OpenCVE
- Debian Security Tracker - CVE-2026-107815
- CVE-2026-107821 - The Hacker Wire
- CVE-2026-107819 - The Hacker Wire
- MariaDB fix commit for CVE-2026-107821 (FRM validation)
- MariaDB Server release 11.8.9
- MariaDB Server release 10.11.19
Detection coverage for TL-2026-3391
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3391 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.