Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Multiple Vulnerabilities in MariaDB Server

16 October 2026

Attackers can exploit high-severity vulnerabilities in MariaDB Server to execute arbitrary code on the affected system. Patch promptly.

Background

MariaDB has released security updates to address multiple vulnerabilities (CVE-2026-107814, CVE-2026-107815, CVE-2026-107818, CVE-2026-107821 and CVE-2026-107823) affecting its MariaDB Server. 

The vulnerabilities have Common Vulnerability Scoring System (CVSS v3.1) scores of:

  • CVE-2026-107814, CVE-2026-107818 at 8.4, 

  • CVE-2026-107815 at 8.5, 

  • CVE-2026-107821 at 8.0, and 

  • CVE-2026-107823 at 7.2, out of 10.

Impact

Successful exploitation of these vulnerabilities could result in the following:

  • CVE-2026-107814: The vulnerability allows a database user with the FILE privilege to write startup dot-files such as .bash_profile into $HOME, which could execute when an administrator opens a login shell for the mysql account.

  • CVE-2026-107815: The vulnerability allows an authenticated user to use the CONNECT engine to cause a crash and potentially execute arbitrary code.

  • CVE-2026-107818: The vulnerability allows a database user with FILE privilege to create /run/mysqld and inject attacker-controlled environment values into the restarted service, if the secure-file-priv configuration permits writes to /run/mysqld.

  • CVE-2026-107821: The vulnerability allows an attacker to place a crafted FRM file in the data directory to trigger out-of-bounds read or write, crash the server, or potentially execute arbitrary code.

  • CVE-2026-107823: The vulnerability allows an authenticated user with the CREATE USER and CREATE VIEW WITH GRANT OPTION to create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata, and potentially escalating database privileges.

Affected Products

These vulnerabilities affect MariaDB Server in the following versions:

  • 10.6.1 to 10.6.27

  • 10.11.1 to 10.11.18

  • 11.4.1 to 11.4.12

  • 11.8.1 to 11.8.8

  • 12.3.1 to 12.3.2

  • 13.0.1

Recommendations

Users and administrators of affected products are advised to update to the latest versions promptly.

References

https://nvd.nist.gov/vuln/detail/cve-2026-107814 (opens in new tab)

https://nvd.nist.gov/vuln/detail/cve-2026-107815 (opens in new tab)

https://nvd.nist.gov/vuln/detail/cve-2026-107818 (opens in new tab)

https://nvd.nist.gov/vuln/detail/cve-2026-107821 (opens in new tab)

https://nvd.nist.gov/vuln/detail/cve-2026-107823 (opens in new tab)

https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw (opens in new tab)

https://cybersecuritynews.com/critical-mariadb-flaws/ (opens in new tab)