Critical MariaDB Flaws Can Let Attackers Execute Code and Steal Database Data

What happened?

MariaDB has disclosed security flaws that, under specific conditions, could let attackers run code, access restricted database tables, and steal login credentials. The issues affect several server branches and MariaDB Connector/C. Although the headline describes a critical risk, the vendor rates the main code execution flaws as High, not Critical. Exploitation depends on installed plugins, account permissions, or unsafe settings. The leading concern is CVE-2026-107815, a memory corruption flaw in the CONNECT storage engine.

Key details

• MariaDB disclosed multiple security flaws allowing code execution, data theft, and credential stealing under specific conditions.
• CVE-2026-107815 is a memory corruption flaw in the CONNECT storage engine rated CVSS 8.5 with demonstrated remote code execution in lab conditions.
• CVE-2026-107821 affects binary .frm file checks, allowing crashes, out-of-bounds reads/writes, and potential remote code execution rated CVSS 8.0.
• CVE-2026-102523 allows reading or changing tables outside normal permissions via unsafe partition name encoding during ALTER TABLE operations rated CVSS 8.0.
• CVE-2026-107819 in Connector/C 3.4.1-3.4.9 lets a man-in-the-middle attacker present a valid certificate for wrong host and request cleartext password authentication.
• Exploitation of the .frm flaw requires FILE privilege and secure-file-priv setting permitting database directory access, limiting real-world impact.
• MariaDB recommends removing unused CONNECT engine plugin, reviewing FILE permissions, and disabling partition support as workarounds.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.