CERT-PY@CERTpy
⚠️ Vulnerabilidades en MariaDB Server ❗ CVE-2026-107821 ❗ CVE-2026-107818 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-mariadb-server/ https://t.co/xIZh4BML3j
00010190
6.7K followersView on X
CVE-2026-107818(mariadb / mariadb)
LOWCVSS 8.4 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
0.0/ 10 priority
Sources & remediation
Vendor / third-party advisories
Other references
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
- https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
Weakness type (CWE)
CWE-15
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- mariadb
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Affected systems
Vendors
Products
mariadb
Deep dive
Activity timeline1 mentions / 1d
Referenced assets1 URL
Full discourse1 post
CPE platform detail1 entries
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mariadb | mariadb | - | - | - |