CVE-2026-44170·MariaDB vulnerability
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
- Severity
- critical
- Software
- MariaDB
- Fixed in
- 11.8.7
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.80% — higher than 52% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Read the two together. CVE-2026-44170 scores 9.8 on CVSS, so a successful attack would be serious — but at 0.80%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.
Affected versions
From: 11.8.1
Until: 11.8.7
Fixed in: 11.8.7
How to fix this CVE
MariaDB servers running on Windows with the CONNECT engine and REST support enabled are vulnerable to remote code execution through improper sanitization of HTTP table attributes in curl commands. Immediately upgrade to MariaDB 11.8.7 or later, or disable the CONNECT engine and REST support if an immediate upgrade is not feasible. Ensure all Windows-based MariaDB deployments are patched to prevent unauthorized command execution.
sudo dnf update mariadb-serverDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
curl command invocation with unsanitized HTTP table attribute values in MariaDB logs or process execution logs; payloads typically include shell metacharacters (|, &, ;, $()), e.g., 'http://attacker.com/table?cmd=<shell_command>'WAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
If MariaDB REST APIs are exposed via a web interface, restrict HTTP requests to known CONNECT table endpoints and implement strict input validation on HTTP table attributes. Block requests containing shell metacharacters (|, &, ;, $, backticks, parentheses) in table attribute parameters.How to check if you are affected
- Check installed MariaDB version: mysql --version or mariadb --version
- Verify CONNECT engine status: SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME='CONNECT';
- Check REST support configuration: SHOW VARIABLES LIKE 'connect_enable_rest'; (should be OFF if not needed)
- Confirm patch applied: SELECT VERSION(); should return 11.8.7 or later for the 11.8.x branch
FAQ
What is CVE-2026-44170?
A critical remote code execution vulnerability in MariaDB's CONNECT engine that allows unauthenticated attackers to execute arbitrary shell commands by injecting malicious input through HTTP table attributes when REST support is enabled on Windows systems.
Is CVE-2026-44170 being actively exploited?
No, this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploits are available at this time. However, the critical severity and ease of exploitation warrant immediate patching.
What versions of MariaDB are affected by CVE-2026-44170?
Affected versions include 10.6.1–10.6.25, 10.11.1–10.11.16, 11.4.1–11.4.10, 11.8.1–11.8.6, and 12.3.1. The vulnerability is patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
How do I check if my server is vulnerable to CVE-2026-44170?
Run 'mariadb --version' to check your version number. If it falls within the affected ranges listed above and the CONNECT engine is loaded with REST enabled, your server is vulnerable.
Does Defensia detect CVE-2026-44170?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-44170 will appear in your dashboard with remediation steps.
Related MariaDB CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-44170. Free for 1 server.
Get started free