high CVSS 7.6

CVE-2026-50147·MariaDB vulnerability

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

Severity
high
Software
MariaDB
Fixed in
1.60.4
Published
2026-07-15

Affected versions

From: 1.60.0

Until: 1.60.4

Fixed in: 1.60.4

How to fix this CVE

Organizations running MariaDB versions 1.60.0 through 1.60.3 must upgrade to version 1.60.4 or later to patch a file disclosure vulnerability that allows privileged database connection configurators to extract sensitive files from the server filesystem. This vulnerability is amplified in environments where Metabase or similar tools manage database connections, as attackers can inject malicious JDBC parameters into connection strings to trigger unauthorized file reads. Immediately apply the patched version and review all database connection configurations for suspicious or unnecessary JDBC parameters.

sudo dnf update mariadb-server

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check installed MariaDB version with: mysql --version or mariadb --version
  2. Step 2: Query the active version in MariaDB: SELECT @@VERSION; — confirm if version is between 1.60.0 and 1.60.3
  3. Step 3: Inspect MariaDB error logs for file I/O patterns: grep -i 'file\|jdbc\|load_file' /var/log/mariadb/error.log
  4. Step 4: Verify patch application by confirming version is 1.60.4 or later, then review database connection configurations for unsafe parameters like allowLoadLocal, allowUrlInLocalInfile, or allowLoadLocalInfileInPath

FAQ

What is CVE-2026-50147?

This vulnerability affects MariaDB versions 1.60.0-1.60.3 and allows high-privilege database connection administrators to read arbitrary files from the server filesystem by injecting unsafe JDBC parameters into MySQL or MariaDB connection strings, potentially exposing configuration files, private keys, and other sensitive data.

Is CVE-2026-50147 being actively exploited?

No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept exploits have been disclosed, though the attack requires only legitimate database configuration privileges.

What versions of MariaDB are affected by CVE-2026-50147?

MariaDB versions 1.60.0, 1.60.1, 1.60.2, and 1.60.3 are vulnerable. Earlier versions (1.57.0–1.57.18, 1.58.0–1.58.13, 1.59.0–1.59.9) are also affected in their respective release streams, with fixes available in 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

How do I check if my server is vulnerable to CVE-2026-50147?

Run: mariadb --version and verify the version number. If it falls between 1.60.0 and 1.60.3, your installation is vulnerable and requires immediate patching. Additionally, check your database connection configurations for JDBC parameters such as allowLoadLocal or allowUrlInLocalInfile.

Does Defensia detect CVE-2026-50147?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-50147 will appear in your dashboard with remediation steps.

Related MariaDB CVEs

CVE-2026-49261CVSS 10MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
CVE-2026-44170CVSS 9.8MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVE-2026-22730CVSS 8.8A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.
CVE-2026-32710CVSS 8.5MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.
CVE-2026-44168CVSS 8MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-50147. Free for 1 server.

Get started free