Vulnerability overview

Patch advisories rarely fail because engineers cannot read a version number. They fail because a single upgrade ticket hides six parallel maintenance branches. CSA Singapore alert AL-2026-144, published 16 October 2026, covers five MariaDB Server vulnerabilities across 10.6, 10.11, 11.4, 11.8, 12.3 and 13.0. The CVSS v3.1 scores are 8.4 for CVE-2026-107814 and CVE-2026-107818, 8.5 for CVE-2026-107815, 8.0 for CVE-2026-107821 and 7.2 for CVE-2026-107823.

Mechanism and exploitation conditions

The five flaws fail in different ways, which is exactly why a partial patch is a false sense of completion. CVE-2026-107814 lets a FILE-privileged user write startup dot-files such as .bash_profile into the service account home. CVE-2026-107818 uses the same privilege to create /run/mysqld and inject environment values during a service restart, subject to secure-file-priv permitting that write.

CVE-2026-107815 involves the CONNECT engine, where an authenticated user can cause a crash and potentially execute code. CVE-2026-107821 depends on placing a crafted FRM file in the data directory to trigger an out-of-bounds read or write. CVE-2026-107823 is privilege escalation: a user with CREATE USER and CREATE VIEW WITH GRANT OPTION can craft a username whose embedded metadata the parser misreads as security metadata.

Impact

Each path lands in a different place. Two end in code execution under the service account, one corrupts data-directory parsing, one escalates privileges inside the database, and one is a crash with escalation potential. A branch left unpatched keeps whichever path it is exposed to.

The reporting risk is the practical problem. A fleet dashboard showing "MariaDB patched" against a single version hides the branches still running older builds. Those are the hosts an attacker will find.

Affected products and scope

Version ranges from the advisory: 10.6.1 to 10.6.27, 10.11.1 to 10.11.18, 11.4.1 to 11.4.12, 11.8.1 to 11.8.8, 12.3.1 to 12.3.2 and 13.0.1. Note that the fixed builds sit at the upper bound of each range, so any host at or below the listed maximum on its branch is in scope.

Exposure context

A ZoomEye query for app="MariaDB" returns 5111720 assets that identify as MariaDB, which is context for scale rather than a vulnerable-host count. Use the query to argue for prioritisation across internet-facing estates, then switch to your own inventory to decide what to patch first.

ZoomEye search: https://www.zoomeye.ai/searchResult?q=YXBwPSJNYXJpYURCIg%3D%3D

Remediation and mitigations

Build the plan per branch, not per CVE. Enumerate every MariaDB instance with its exact build string, group by branch, and open one change record per branch with a named owner. Verify after the change by re-reading the version from the running server, because package metadata and the live process can disagree after a failed restart.

In parallel, reduce dependence on the risky privileges while change windows are being scheduled. Revoke FILE from accounts that only export reports, set secure-file-priv to a dedicated path, and remove GRANT OPTION from accounts that define views. Those steps cut exposure for three of the five flaws without waiting for a maintenance window.

Finally, close the loop. A patched fleet is only verified when the next inventory scan reconciles against the branch list, not when the change ticket is marked done.

References