CVE-2026-44169·MariaDB vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.16% — higher than 6% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Update MariaDB to version 11.8.7 or later to patch a privilege escalation vulnerability affecting stored routine visibility. Users with EXECUTE access to stored routines via roles could previously view routine definitions without explicit SHOW CREATE ROUTINE permissions. Upgrade immediately to restore proper access controls and prevent unauthorized information disclosure.

sudo dnf update mariadb-server

How to check if you are affected

1. Step 1: Check the installed MariaDB version by running `mariadb --version` or connecting to the server and executing `SELECT VERSION();`
2. Step 2: Identify all stored routines in your databases by querying `SELECT ROUTINE_SCHEMA, ROUTINE_NAME, ROUTINE_TYPE FROM INFORMATION_SCHEMA.ROUTINES;`
3. Step 3: Review MariaDB audit logs (if enabled) for EXECUTE statements on stored procedures by users who lack SHOW CREATE ROUTINE privilege
4. Step 4: After upgrading to 11.8.7 or later, verify the fix by confirming version with `SELECT VERSION();` and test that users without SHOW CREATE ROUTINE can no longer view routine definitions

FAQ

Related MariaDB CVEs

References

• https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2
• https://jira.mariadb.org/browse/MDEV-39288