CVE-2026-61700 is an improper access control vulnerability in MariaDB Connector/J affecting versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9. The flaw allows a rogue or man-in-the-middle server to cause the connector to transmit a local file despite the allowLocalInfile option being disabled, but only the exact file requested by the application can be sent. Exploitation requires an application that loads sensitive data over an untrusted connection. This issue has a CVSS score of 3.7 (medium severity) and is fixed in the specified versions.
MariaDB Connector/R2DBC versions prior to 1.4.1 do not prevent cleartext password authentication plugins from being used over unencrypted connections. This allows a malicious or man-in-the-middle MariaDB server to request cleartext password authentication over plain TCP, exposing user credentials in transit. The vulnerability is fixed in version 1.4.1.
MariaDB Connector/R2DBC versions prior to 1.4.1 improperly handle mid-session changes to the character_set_client encoding when it is changed from UTF-8 to another character set. This causes a mismatch between client and server character encoding, leading to silent data corruption and potential bypass of byte-wise quoting or escaping. The issue is fixed in version 1.4.1 by restricting accepted character sets to utf8, utf8mb3, or utf8mb4 after initialization, closing the connection otherwise.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 have a vulnerability where the connector incorrectly assumes the connection character set is UTF-8 throughout the session. If the server changes the character_set_client to a non-UTF-8 encoding mid-session, the driver continues to encode/decode as UTF-8, causing silent data corruption and charset confusion. This can defeat client-side escaping and quoting mechanisms. The issue is fixed by restricting allowed character sets after initialization to utf8, utf8mb3, or utf8mb4, with other values causing the connection to close with an error.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 have a vulnerability where PAM dialog authentication can transmit the account password in cleartext over insecure connections. This occurs because the PAM handler 'dialog' does not require secure transport, unlike the mysql_clear_password plugin. A malicious or man-in-the-middle server can exploit this by sending an Authentication Switch Request over plain TCP, causing the driver to expose the password if sslMode=DISABLE and restrictedAuth=null (default settings). The issue is fixed in the specified versions.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 contain a vulnerability where the initial handshake path does not properly enforce certificate fingerprint verification. This allows a man-in-the-middle or hostile server to present a self-signed certificate and receive the full database password via the mysql_clear_password authentication plugin before the connection is rejected.
MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a SQL injection vulnerability when using certain client character sets (big5, gbk, sjis, cp932, or gb18030). This occurs due to improper escaping of attacker-controlled Buffer parameters client-side, allowing an attacker to inject arbitrary SQL. The default utf8mb4 character set and prepared-statement execution paths are not affected. The vulnerability can lead to exposure or modification of data accessible to the database account. Fixed versions are available.
MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 can expose account passwords in cleartext during PAM dialog authentication over insecure transport. This occurs because the connector does not enforce secure transport for the PAM password authentication dialog, allowing a hostile or on-path server to trigger password disclosure over plain TCP. The issue is mitigated by using properly verified TLS or local Unix sockets. The vulnerability has a CVSS score of 5.9 (medium severity) and is fixed in the specified versions.
MariaDB Connector/Node.js versions prior to 3.3.3, 3.4.6, and 3.5.3 have an improper certificate validation vulnerability. When SSL is enabled without a pinned CA or server certificate, the connector may send credentials before completing certificate fingerprint validation. This allows a man-in-the-middle attacker to present a self-signed certificate, capture the database password, and authenticate directly even though the connection is later closed. The issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.
A path traversal vulnerability (CWE-22) exists in the mbstream component of MariaDB server versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and exactly 12.3.1. The vulnerability allows specially crafted archives containing '/../' sequences to cause mbstream to write files outside the intended target directory during archive unpacking. This issue has been addressed in MariaDB server versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.
MariaDB Server versions through 11.8.5 with the server audit plugin enabled and configured to filter QUERY_DCL, QUERY_DDL, or QUERY_DML events do not log SQL statements that begin with double-hyphen (--) or hash (#) style comments when executed by authenticated users. This results in incomplete audit logs for such statements, potentially impacting audit completeness.