Vulnerabilities / CVE-2026-44170

critical

CVE-2026-44170

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

Published Modified CWE 78
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Bitnami10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami, Photon OS. Rated lower by Red Hat (high), AlmaLinux (high), Oracle (high), Rocky Linux (high).

Description

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Affected packages and fixed versions

SourcePackageFixed in
bitnami::Bitnami Vulnerability Databasemariadb, mariadb-min, mysql-client10.6.26, 10.11.17, 11.4.11, 11.8.7, 12.3.2
Photon OS 4.0mariadb, mariadb-devel, mariadb-errmsg and 2 more10.11.18-1.ph4
alma 8mariadb:10.11::Judy, mariadb:10.11::galera, mariadb:10.11::mariadb and 13 more1.0.5-18.module_el8.10.0+3794+c6a66d65 and 2 more
alpine 3.20mariadb10.11.17-r0
alpine 3.21mariadb11.4.11-r0
alpine 3.22mariadb11.4.11-r0
alpine 3.23mariadb11.4.11-r0
alpine 3.24mariadb11.8.7-r0
alpine edgemariadb11.8.7-r0
chainguardmariadb-11.811.8.9-r1
echomariadb1:11.8.6-6+e4
minimosmariadb-10.11, mariadb-10.6, mariadb-11.4 and 2 more10.11.17-r0 and 4 more
Show all 223 entries from 32 sources
SourcePackageFixed in
bitnami::Bitnami Vulnerability Databasemariadb10.6.26, 10.11.17, 11.4.11, 11.8.7, 12.3.2
bitnami::Bitnami Vulnerability Databasemariadb-min10.6.26, 10.11.17, 11.4.11, 11.8.7, 12.3.2
bitnami::Bitnami Vulnerability Databasemysql-client10.6.26, 10.11.17, 11.4.11, 11.8.7, 12.3.2
Photon OS 4.0mariadb10.11.18-1.ph4
Photon OS 4.0mariadb-devel10.11.18-1.ph4
Photon OS 4.0mariadb-errmsg10.11.18-1.ph4
Photon OS 4.0mariadb-server10.11.18-1.ph4
Photon OS 4.0mariadb-server-galera10.11.18-1.ph4
alma 8mariadb:10.11::Judy1.0.5-18.module_el8.10.0+3794+c6a66d65
alma 8mariadb:10.11::galera26.4.27-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-backup3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-common3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-devel3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-embedded3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-embedded-devel3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-errmsg3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-gssapi-server3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-oqgraph-engine3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-pam3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-server3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-server-galera3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-server-utils3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alma 8mariadb:10.11::mariadb-test3:10.11.18-1.module_el8.10.0+4207+a44b0e1e
alpine 3.20mariadb10.11.17-r0
alpine 3.21mariadb11.4.11-r0
alpine 3.22mariadb11.4.11-r0
alpine 3.23mariadb11.4.11-r0
alpine 3.24mariadb11.8.7-r0
alpine edgemariadb11.8.7-r0
chainguardmariadb-11.811.8.9-r1
echomariadb1:11.8.6-6+e4
minimosmariadb-10.1110.11.17-r0
minimosmariadb-10.610.6.26-r0
minimosmariadb-11.411.4.11-r0
minimosmariadb-11.811.8.7b-r0
minimosmariadb-12.312.3.2-r0
rapidfort alma 10mariadb3:10.11.18-1.el10_0
rapidfort alma 10mariadb-backup3:10.11.18-1.el10_0
rapidfort alma 10mariadb-client-utils3:10.11.18-1.el10_0
rapidfort alma 10mariadb-common3:10.11.18-1.el10_0
rapidfort alma 10mariadb-devel3:10.11.18-1.el10_0
rapidfort alma 10mariadb-embedded3:10.11.18-1.el10_0
rapidfort alma 10mariadb-embedded-devel3:10.11.18-1.el10_0
rapidfort alma 10mariadb-errmsg3:10.11.18-1.el10_0
rapidfort alma 10mariadb-gssapi-server3:10.11.18-1.el10_0
rapidfort alma 10mariadb-oqgraph-engine3:10.11.18-1.el10_0
rapidfort alma 10mariadb-pam3:10.11.18-1.el10_0
rapidfort alma 10mariadb-server3:10.11.18-1.el10_0
rapidfort alma 10mariadb-server-galera3:10.11.18-1.el10_0
rapidfort alma 10mariadb-server-utils3:10.11.18-1.el10_0
rapidfort alma 10mariadb-test3:10.11.18-1.el10_0
rapidfort alma 10mariadb11.83:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-backup3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-client-utils3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-common3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-devel3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-embedded3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-embedded-devel3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-errmsg3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-gssapi-server3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-oqgraph-engine3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-pam3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-server3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-server-galera3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-server-utils3:11.8.8-1.el10_2
rapidfort alma 10mariadb11.8-test3:11.8.8-1.el10_2
rapidfort alpine 3.20mariadb10.11.17-r0, 11.4.11-r0, 11.4.8-r0
rapidfort alpine 3.21mariadb11.4.11-r0, 11.4.8-r0
rapidfort alpine 3.22mariadb11.4.11-r0, 11.4.8-r0
rapidfort alpine 3.23mariadb11.4.11-r0, 11.4.8-r0
rapidfort alpine 3.24mariadb11.4.11-r0
rapidfort amazon linux 2023mariadb105no fix listed
rapidfort debian 12rf-mariadb1:10.11.17, 1:11.4.11
rapidfort debian 13rf-mariadb1:10.11.17, 1:11.4.11
rapidfort fedora 43mariadb3:10.11.18-2.fc43
rapidfort fedora 43mariadb10.113:10.11.18-2.fc43
rapidfort fedora 43mariadb11.83:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-backup3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-client-utils3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-common3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-connect-engine3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-cracklib-password-check3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-devel3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-embedded3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-embedded-devel3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-errmsg3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-gssapi-server3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-oqgraph-engine3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-pam3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-rocksdb-engine3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-s3-engine3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-server3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-server-galera3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-server-utils3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-sphinx-engine3:11.8.8-1.fc43
rapidfort fedora 43mariadb11.8-test3:11.8.8-1.fc43
rapidfort Oracle Linux 10galera0:26.4.27-1.el10_2
rapidfort Oracle Linux 10mariadb3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-backup3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-client-utils3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-common3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-devel3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-embedded3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-embedded-devel3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-errmsg3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-gssapi-server3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-oqgraph-engine3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-pam3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-server3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-server-galera3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-server-utils3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb-test3:10.11.18-1.el10_0
rapidfort Oracle Linux 10mariadb11.83:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-backup3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-client-utils3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-common3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-devel3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-embedded3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-embedded-devel3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-errmsg3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-gssapi-server3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-oqgraph-engine3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-pam3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-server3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-server-galera3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-server-utils3:11.8.8-1.el10_2
rapidfort Oracle Linux 10mariadb11.8-test3:11.8.8-1.el10_2
rapidfort Oracle Linux 9galera26.4.9-2.0.2.el9
rapidfort Oracle Linux 9mariadb3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-backup3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-client-utils3:11.8.8-1.module+el9.8.0+24389+c97c30be.noarch::mariadb:11
rapidfort Oracle Linux 9mariadb-common3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-devel3:10.11.18-1.module+el9.8.0+24388+85f1c439.aarch64::mariadb:10
rapidfort Oracle Linux 9mariadb-embedded3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-embedded-devel3:10.11.18-1.module+el9.8.0+24388+85f1c439.aarch64::mariadb:10
rapidfort Oracle Linux 9mariadb-errmsg3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-gssapi-server3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-oqgraph-engine3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-pam3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-server3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-server-galera3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-server-utils3:10.5.13-2.el9
rapidfort Oracle Linux 9mariadb-test3:10.11.18-1.module+el9.8.0+24388+85f1c439.aarch64::mariadb:10
rapidfort rocky 9galera0:26.4.27-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb-backup3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb-common3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb-embedded3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb-errmsg3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb-gssapi-server3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb-oqgraph-engine3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb-pam3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb-server3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb-server-galera3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort rocky 9mariadb-server-utils3:10.11.18-1.module+el9.8.0+40232+a354f53a
rapidfort ubuntu 20.04rf-mariadb1:10.11.14-0ubuntu0.24.04.1
rapidfort ubuntu 22.04rf-mariadb1:10.11.14-0ubuntu0.24.04.1
rapidfort ubuntu 24.04rf-mariadb1:10.11.14-0ubuntu0.24.04.1
rocky 10galera0.0.0
rocky 10mariadb0.0.0
rocky 10mariadb-backup0.0.0
rocky 10mariadb-client-utils0.0.0
rocky 10mariadb-common3:10.11.18-1.el10_2
rocky 10mariadb-devel0.0.0
rocky 10mariadb-embedded0.0.0
rocky 10mariadb-embedded-devel0.0.0
rocky 10mariadb-errmsg3:10.11.18-1.el10_2
rocky 10mariadb-gssapi-server0.0.0
rocky 10mariadb-oqgraph-engine0.0.0
rocky 10mariadb-pam0.0.0
rocky 10mariadb-server0.0.0
rocky 10mariadb-server-galera0.0.0
rocky 10mariadb-server-utils0.0.0
rocky 10mariadb-test0.0.0
rocky 10mariadb11.80.0.0
rocky 10mariadb11.8-backup0.0.0
rocky 10mariadb11.8-client-utils3:11.8.8-1.el10_2
rocky 10mariadb11.8-common3:11.8.8-1.el10_2
rocky 10mariadb11.8-devel0.0.0
rocky 10mariadb11.8-embedded0.0.0
rocky 10mariadb11.8-embedded-devel0.0.0
rocky 10mariadb11.8-errmsg3:11.8.8-1.el10_2
rocky 10mariadb11.8-gssapi-server0.0.0
rocky 10mariadb11.8-oqgraph-engine0.0.0
rocky 10mariadb11.8-pam0.0.0
rocky 10mariadb11.8-server0.0.0
rocky 10mariadb11.8-server-galera0.0.0
rocky 10mariadb11.8-server-utils3:11.8.8-1.el10_2
rocky 10mariadb11.8-test0.0.0
rocky 8mariadb:10.11::Judy1.0.5-18.module+el8.4.0+427+adf35707
rocky 8mariadb:10.11::galera26.4.27-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-backup3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-common3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-devel3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-embedded3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-embedded-devel3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-errmsg3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-gssapi-server3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-oqgraph-engine3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-pam3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-server3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-server-galera3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-server-utils3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 8mariadb:10.11::mariadb-test3:10.11.18-1.module+el8.10.0+40224+8b6e3f53
rocky 9mariadb:11.8::galera26.4.27-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-backup3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-client-utils3:11.8.8-1.module+el9.8.0+40229+87be66a2
rocky 9mariadb:11.8::mariadb-common3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-devel3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-embedded3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-embedded-devel3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-errmsg3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-gssapi-server3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-oqgraph-engine3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-pam3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-server3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-server-galera3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-server-utils3:10.11.18-1.module+el9.8.0+40232+a354f53a
rocky 9mariadb:11.8::mariadb-test3:10.11.18-1.module+el9.8.0+40232+a354f53a
wolfimariadb-11.811.8.9-r1

References

All 34 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.