# MariaDB Server and Connector/C Flaws Enable Code Execution, Data Access and Credential Exposure (CVE-2026-107815, CVE-2026-107821, CVE-2026-102523, CVE-2026-107819)

> Four MariaDB flaws were fixed in the October 2026 releases: a CONNECT-engine stack out-of-bounds write (CVSS 8.5), crafted binary .frm file handling (8.0), unsafe partition-name encoding (8.0) and a Connector/C hostname-verification flaw that can expose passwords to a man-in-the-middle (5.9). Remote code execution was shown only under laboratory conditions and no in-the-wild exploitation is reported.

- **Published:** 2026-10-13T09:42:21Z
- **Last reviewed:** 2026-10-13T12:15:55.950Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3391
- **ID:** TL-2026-3391
- **Severity:** HIGH (CVSS 8.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-107815, CVE-2026-107821, CVE-2026-102523, CVE-2026-107819, CVE-2026-107814, CVE-2026-107818, CVE-2026-107817, CVE-2026-107816, CVE-2026-107822, CVE-2026-107823

## Description

CVE-2026-107815 (CWE-787, CVSS 3.1 8.5, vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) affects the CONNECT storage engine's DOS table type. An incorrect boundary check permits a one-byte NULL write beyond a stack buffer at an attacker-specified offset. The GitHub advisory (GHSA-4wgx-ffg9-jrwq, credited to HackerOne reporter dstesk) states this 'was demonstrated to cause a remote code execution in the lab conditions'. An authenticated user permitted to use the CONNECT engine can crash the server (denial of service) and potentially achieve code execution. Affected: MariaDB 10.6.1-10.6.27, 10.11.1-10.11.18, 11.4.1-11.4.12, 11.8.1-11.8.8, 12.3.1-12.3.2 and 13.0.1 (the secondary article lists 10.11.1-10.11.19, which conflicts with the advisory and the 10.11.19 fix). Tracked as MDEV-40637; fix commit b369925f6855d3e1f0ebcf453492724b99fda6f8. The advisory's mitigation is to uninstall the CONNECT plugin when it is not needed.

CVE-2026-107821 (CWE-1285, CVSS 3.1 8.0, vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H; GHSA-c4gx-34mg-95q5, credited to pinebudweiser and Ph4nt0m) is caused by insufficient validation of counts, offsets, lengths and field boundaries in FRM metadata when MariaDB parses binary .frm files. An attacker able to place a crafted .frm file in the data directory can trigger out-of-bounds reads or writes, crash the server, or potentially execute code. Exploitation needs the FILE privilege together with a secure-file-priv setting that permits writing into the database directory; correctly configured servers block this. Tracked as MDEV-40571; fix commit 3b1c2e58abab5571bec4ff52773ddc75b1738da9. Same affected ranges as CVE-2026-107815.

CVE-2026-102523 (CWE-73, CVSS 3.1 8.0, vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H; GHSA-h4vr-wpff-jfx4) concerns improper encoding of partition names for the filesystem during ALTER TABLE ... CONVERT ... PARTITION, letting a low-privileged user (with some user interaction) read or modify tables beyond their assigned permissions. Affected: 10.11.1-10.11.18, 11.4.1-11.4.12, 11.8.1-11.8.8, 12.3.1-12.3.2 and 13.0.1; the 10.6 branch is not affected. Credits: Ben Bidner (Automattic Security Team) as discoverer and vortfu as reporter. Advisory remediation option: start the server with --skip-plugin-partition to disable partition support.

CVE-2026-107819 (CWE-297, CVSS 3.1 5.9, vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) affects MariaDB Connector/C (libmariadb) 3.4.1-3.4.9. A programming mistake in SSL authentication logic lets an active man-in-the-middle holding a valid certificate for a different hostname bypass hostname verification, request cleartext password authentication and capture the client's password. The Hacker Wire entry lists the range as through 3.4.10, which conflicts with 3.4.10 being the fixed release. Other MariaDB connectors are unaffected. Tracked as CONC-846 / GHSA-fmq9-qjxj-qpf7 (the GitHub advisory page could not be retrieved); fix commit e8c0a16d94ddf844668d684a7d42b37ac8e0fc02.

All issues were fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 (server) and Connector/C 3.4.10. The three server GHSA pages show a publication date of 2026-09-07, while CVE aggregators and the media report date publication to 2026-10-09 and 2026-10-13; this record uses the earliest dated primary source. The vendor reports no confirmed attacks against live systems and no public PoC or IOCs were identified. Debian Bookworm and Trixie were still listed as vulnerable (1:10.11.18 and 1:11.8.6) at the time of the tracker snapshot.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1557 Adversary-in-the-Middle
- T1040 Network Sniffing
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1565.001 Stored Data Manipulation
- T1059 Command and Scripting Interpreter
- T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1499 Endpoint Denial of Service

## Sources

- [Critical MariaDB Flaws Can Let Attackers Execute Code and Steal Database Data](https://cybersecuritynews.com/critical-mariadb-flaws/)
- [GHSA-4wgx-ffg9-jrwq - MariaDB CONNECT engine DOS table out-of-bounds write (CVE-2026-107815)](https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq)
- [GHSA-c4gx-34mg-95q5 - MariaDB binary FRM validation (CVE-2026-107821)](https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5)
- [GHSA-h4vr-wpff-jfx4 - MariaDB partition name encoding (CVE-2026-102523)](https://github.com/MariaDB/server/security/advisories/GHSA-h4vr-wpff-jfx4)
- [CVE-2026-107815 - OpenCVE](https://app.opencve.io/cve/CVE-2026-107815)
- [Debian Security Tracker - CVE-2026-107815](https://security-tracker.debian.org/tracker/CVE-2026-107815)
- [CVE-2026-107821 - The Hacker Wire](https://www.thehackerwire.com/vulnerability/CVE-2026-107821/)
- [CVE-2026-107819 - The Hacker Wire](https://www.thehackerwire.com/vulnerability/CVE-2026-107819/)
- [MariaDB fix commit for CVE-2026-107821 (FRM validation)](https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9)
- [MariaDB Server release 11.8.9](https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9)
- [MariaDB Server release 10.11.19](https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3391