CVE-2026-44169— MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions

CVSS 4.3 · Medium EPSS 0.03% · P8 Updated Jun 13, 2026

Possible ATT&CK Techniques 1AI

Affected Version Matrix 3

Vendor	Product	Version Range	Status
MariaDB	server	`>= 11.4.1, < 11.4.11`	affected
		`>= 11.8.1, < 11.8.7`	affected
		`>= 12.3.1, < 12.3.2`	affected

Get alerts for future matching vulnerabilitiesLog in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions

Source: NVD (National Vulnerability Database)

Vulnerability Description

MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.

Source: NVD (National Vulnerability Database)

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: NVD (National Vulnerability Database)

Vulnerability Type

授权机制不正确

Source: NVD (National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
MariaDB	server	>= 11.4.1, < 11.4.11	-

II. Public POCs for CVE-2026-44169

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2026-44169

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-44169 (1)

🔗 Authorization bypass in role-based routine-level privilege check exposes stored routine definitions · Advisory · MariaDB/server · GitHub Read full article x_refsource_CONFIRM

Other References for CVE-2026-44169 (1)

🔗 [MDEV-39288] SHOW CREATE ROUTINE does not apply to roles - Jirax_refsource_MISC

https://nvd.nist.gov/vuln/detail/CVE-2026-44169

Same Patch Batch · MariaDB · 2026-06-12 · 8 CVEs total

CVE-2026-48165	8.0 HIGH	MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side
CVE-2026-48163	8.0 HIGH	MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)
CVE-2026-44168	8.0 HIGH	MariaDB: wsrep SST unsafe parameter handling on the donor side
CVE-2026-44171	6.3 MEDIUM	MariaDB: path traversal in mbstream
CVE-2026-44173	5.0 MEDIUM	MariaDB: FILE privilege was not checked for subqueries in the FROM clause
CVE-2026-44170		MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL
CVE-2026-44172		MariaDB: mysql_real_escape_string() incorrectly handled big5

IV. Related Vulnerabilities

Same product: server

Same vendor: MariaDB

Same weakness: CWE-863

V. Comments for CVE-2026-44169

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-44169— MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions

Possible ATT&CK Techniques 1AI

Affected Version Matrix 3

I. Basic Information for CVE-2026-44169

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-44169

III. Intelligence Information for CVE-2026-44169

Vendor Advisories for CVE-2026-44169 (1)

Other References for CVE-2026-44169 (1)

Same Patch Batch · MariaDB · 2026-06-12 · 8 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-44169

Leave a comment