Critical severity · published Jun 12, 2026
CVE-2026-44170
MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
server · MariaDB
>= 10.6.1, < 10.6.26; >= 10.11.1, < 10.11.17; >= 11.4.1, < 11.4.11; >= 11.8.1, < 11.8.7; >= 12.3.1, < 12.3.2 · source: vendor
MA
Mariadb · Mariadb
10.6.1 before 10.6.26; 10.11.1 before 10.11.17; 11.4.1 before 11.4.11; 11.8.1 before 11.8.7; 12.3.1 · source: NVD
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Hardened Images · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44170
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44170
Third Party Advisory
https://github.com/MariaDB/server/security/advisories/GHSA-f835-cfjq-wf73
Third Party Advisory
https://jira.mariadb.org/browse/MDEV-39289
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:25143
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:25145
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:33093
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:33412
More from server
9.9
CVE-2026-85748
MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
9.9
CVE-2026-85746
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
9.9
CVE-2026-92262
MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
9.9
CVE-2026-32710
Heap-based Buffer Overflow in MariaDB
9.8
CVE-2026-49261
MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`