This vulnerability (CVE-2026-3494) affects MariaDB Server versions through 11.8.5 and relates to insufficient logging (CWE-778) when the server audit plugin is configured with QUERY_DCL, QUERY_DDL, or QUERY_DML event filters. SQL statements prefixed with '--' or '#' comments by authenticated users are omitted from audit logs, which can lead to gaps in auditing and monitoring of database activities. No patch or official remediation guidance has been published by the vendor, and no exploitation in the wild is known.

The impact is limited to incomplete audit logs for certain SQL statements that use comment prefixes, which may hinder forensic analysis and detection of unauthorized or malicious activities. There is no direct impact on confidentiality, availability, or integrity of data reported. The CVSS score of 4.3 reflects a medium severity due to the potential for reduced audit effectiveness rather than direct compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be aware of the logging limitations when using the audit plugin with the specified event filters. Consider additional monitoring or compensating controls to detect suspicious database activity that might be missed due to this logging gap.