CVE-2026-3494

MariaDB Server Audit Plugin Comment Handling Bypass

State: Published
Severity: 5.3 Medium
Published: Mar 3, 2026
Updated: Oct 20, 2026
Reserved: Mar 3, 2026

Description

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	AMZN
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	AMZN

Weaknesses

CWE-778 (Insufficient Logging)

Affected Products

Product	Versions
MariaDB ServerMariaDB Foundation	before 10.6.25Affected before 10.11.16Affected before 11.4.10Affected before 11.8.6Affected
Aurora MySQLAmazon	before 2.12.6Affected before 3.04.6Affected before 3.10.3Affected before 3.11.1Affected
RDS for MySQLAmazon	before 5.7.44-RDS.20260212Affected before 8.0.45Affected before 8.4.8Affected
RDS for MariaDBAmazon	before 10.6.25Affected before 10.11.16Affected before 11.4.10Affected before 11.8.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.