Vulnerability · Published Mar 3, 2026 · Assigned by AMZN
CVE-2026-3494MariaDB Server Audit Plugin Comment Handling Bypass
Medium 4.3
In plain English
A medium-severity security flaw in Aurora MySQL from Amazon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | mariadb | 10.11.16-r0 | ALPINE-CVE-2026-3494 |
| Alpine:v3.21 | mariadb | 11.4.10-r0 | ALPINE-CVE-2026-3494 |
| Alpine:v3.22 | mariadb | 11.4.10-r0 | ALPINE-CVE-2026-3494 |
| Alpine:v3.23 | mariadb | 11.4.10-r0 | ALPINE-CVE-2026-3494 |
| Alpine:v3.24 | mariadb | 11.8.6-r0 | ALPINE-CVE-2026-3494 |
| Debian:12 | mariadb | 1:10.11.18-0+deb12u1 | DEBIAN-CVE-2026-3494 |
| Debian:13 | mariadb | 1:11.8.6-0+deb13u1 | DEBIAN-CVE-2026-3494 |
| Debian:14 | mariadb | 1:11.8.6-1 | DEBIAN-CVE-2026-3494 |
| Ubuntu:24.04:LTS | mariadb | no fix listed | UBUNTU-CVE-2026-3494 |
| Ubuntu:22.04:LTS | mariadb-10.6 | no fix listed | UBUNTU-CVE-2026-3494 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MariaDB Foundation | MariaDB Server | 0 – before 10.6.250 – before 10.11.160 – before 11.4.100 – before 11.8.6 |
| Amazon | Aurora MySQL | 0 – before 2.12.60 – before 3.04.60 – before 3.10.30 – before 3.11.1 |
| Amazon | RDS for MySQL | 0 – before 5.7.44-RDS.202602120 – before 8.0.450 – before 8.4.8 |
| Amazon | RDS for MariaDB | 0 – before 10.6.250 – before 10.11.160 – before 11.4.100 – before 11.8.6 |
Weakness: CWE-778 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N