CVE-2026-3494— MariaDB Server Audit Plugin Comment Handling Bypass
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-3494
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MariaDB Server Audit Plugin Comment Handling Bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
不充分的日志记录
Source: NVD (National Vulnerability Database)
Vulnerability Title
MCP MariaDB Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MCP MariaDB Server是MariaDB开源的一个大语言模型上下文协议的服务器实现。 MCP MariaDB Server 11.8.5及之前版本存在安全漏洞，该漏洞源于启用服务器审计插件并配置特定过滤事件时，以特定注释前缀的SQL语句不会被记录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MariaDB Foundation | MariaDB Server | - | - | |
| Amazon | Aurora MySQL | - | - | |
| Amazon | RDS for MySQL | - | - | |
| Amazon | RDS for MariaDB | - | - |
II. Public POCs for CVE-2026-3494
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-3494
请登录查看更多情报信息。
- MariaDB Server Audit Plugin Comment Handling Bypassvendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-3494
IV. Related Vulnerabilities
Same weakness: CWE-778
V. Comments for CVE-2026-3494
No comments yet