CVE-2026-3494: MariaDB Server Audit Plugin Comment Handling Bypass

Description

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 21% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AM

Aurora MySQL · Amazon

before 2.12.6; before 3.04.6; before 3.10.3; before 3.11.1 · source: vendor, NVD

MS

MariaDB Server · MariaDB Foundation

before 10.6.25; before 10.11.16; before 11.4.10; before 11.8.6 · source: vendor

RF

RDS for MariaDB · Amazon

before 10.6.25; before 10.11.16; before 11.4.10; before 11.8.6 · source: vendor

RF

RDS for MySQL · Amazon

before 5.7.44-RDS.20260212; before 8.0.45; before 8.4.8 · source: vendor

MA

Mariadb · Mariadb

through 10.6.24; 10.7.0 through 10.11.15; 11.0.0 through 11.4.9; 11.5.0 through 11.8.5 · source: NVD

RD

Relational Database Service · Amazon

through 5.7.44-rds.20251212; through 10.6.24; 8.0.11 through 8.0.44; 8.4.3 through 8.4.7; 10.11.4 through 10.11.15; 11.4.3 through 11.4.9; +1 more · source: NVD