This update for MariaDB fixes nine security vulnerabilities identified by CVE identifiers CVE-2026-3494, CVE-2026-44168, CVE-2026-44170, CVE-2026-44171, CVE-2026-44172, CVE-2026-44173, CVE-2026-48163, CVE-2026-48165, and CVE-2026-49261. The vulnerabilities include audit plugin comment handling bypass, unsafe parameter handling in wsrep SST on donor and joiner sides, argument injection via unsanitized URLs in CONNECT REST Xcurl on Windows, path traversal in mbstream, incorrect handling of big5 encoding in mysql_real_escape_string(), missing FILE privilege checks in subqueries, and unsafe usage of wsrep_notify_cmd parameters. These fixes are incorporated in MariaDB community server version 10.6.27 as published by the SUSE Product Security Team.

The vulnerabilities collectively could allow attackers to bypass security controls, inject malicious arguments, perform path traversal, and exploit unsafe parameter handling in replication and connection components of MariaDB. This could lead to unauthorized access, privilege escalation, or disruption of database operations. However, no known exploits in the wild have been reported according to the advisory.

A security update is available and should be applied by upgrading to MariaDB version 10.6.27 or later as provided by the SUSE Product Security Team. This update addresses all listed vulnerabilities. There is no indication that additional mitigations are required beyond applying the official update.