high CVSS 8.4 EPSS 0.28%

CVE-2026-107814·MariaDB vulnerability

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Severity
high
Software
MariaDB
Fixed in
13.0.2
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.28% — higher than 19% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-107814 scores 8.4 on CVSS, so a successful attack would be serious — but at 0.28%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 13.0.1

Until: 13.0.2

Fixed in: 13.0.2

How to fix this CVE

Update MariaDB to version 13.0.2 or later to remediate a privilege escalation vulnerability in RPM-based distributions. The vulnerability allows database users with FILE privileges to inject malicious startup scripts into the mysql service account's home directory, which execute with elevated privileges when an administrator logs in. Apply the security patch immediately to prevent unauthorized command execution.

sudo dnf update mariadb-server

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check the installed MariaDB version: mysql --version or mariadb --version
  2. Step 2: Query the database for users with FILE privilege: SELECT user, host FROM mysql.user WHERE File_priv='Y';
  3. Step 3: Inspect the mysql service account home directory for suspicious dotfiles: ls -la /var/lib/mysql/ | grep -E '^\.bash|^\.profile|^\.bashrc' (if using RPM packages)
  4. Step 4: Verify the patch was applied by confirming the version is 13.0.2 or higher and checking the service account home directory is now /nonexistent or a restricted path: getent passwd mysql | cut -d: -f6

FAQ

What is CVE-2026-107814?

This vulnerability affects MariaDB RPM packages where the mysql service account's home directory is configured as the database data directory. A database user with FILE privileges can write shell startup scripts (like .bash_profile) into this directory, allowing arbitrary command execution when an administrator opens a login shell for the mysql account.

Is CVE-2026-107814 being actively exploited?

No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available, though the attack vector is straightforward for users with FILE privilege access.

What versions of MariaDB are affected by CVE-2026-107814?

MariaDB versions 10.6.1–10.6.27, 10.11.0–10.11.18, 11.4.0–11.4.12, 11.8.0–11.8.8, 12.3.0–12.3.2, and 13.0.0–13.0.1 are vulnerable. The issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

How do I check if my server is vulnerable to CVE-2026-107814?

Run 'mariadb --version' to determine your version. If it is 13.0.1 or earlier (or any version in the affected ranges), check if FILE privilege users exist with 'SELECT user, host FROM mysql.user WHERE File_priv="Y";'. Additionally, verify the mysql account home directory with 'getent passwd mysql' — vulnerability is present only on RPM systems where the home directory is not /nonexistent.

Does Defensia detect CVE-2026-107814?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-107814 will appear in your dashboard with remediation steps.

Related MariaDB CVEs

CVE-2026-49261CVSS 10MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
CVE-2026-85748CVSS 9.9MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.
CVE-2026-85746CVSS 9.9MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-92262CVSS 9.9MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-44170CVSS 9.8MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-107814. Free for 1 server.

Get started free