CVE-2026-3494

Published: Mar 3, 2026Modified: Mar 16, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5 (Secondary)

Description

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

Affected (15)

Products: Mariadb: Mariadb · Amazon: Aurora Mysql, Relational Database Service

1 product

2 products

Relational Database Service

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mariadb Mariadb	Up to 10.6.24
Mariadb Mariadb	From 10.7.0 to 10.11.15
Mariadb Mariadb	From 11.0.0 to 11.4.9
Mariadb Mariadb	From 11.5.0 to 11.8.5

Configuration B

11 vulnerable

Vulnerable Software	Affected Versions
Amazon Aurora Mysql	Up to 2.12.5
Amazon Aurora Mysql	From 3.01.0 to 3.04.5
Amazon Aurora Mysql	From 3.05.1 to 3.10.2
Amazon Aurora Mysql	Version 3.11.0
Amazon Relational Database Service	Up to 10.6.24
Amazon Relational Database Service	From 10.11.4 to 10.11.15
Amazon Relational Database Service	From 11.4.3 to 11.4.9
Amazon Relational Database Service	From 11.8.3 to 11.8.5
Amazon Relational Database Service	Up to 5.7.44-rds.20251212
Amazon Relational Database Service	From 8.0.11 to 8.0.44
Amazon Relational Database Service	From 8.4.3 to 8.4.7

Related CWEs

CWE-778

Insufficient Logging

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

References (3)

https://aws.amazon.com/security/security-bulletins/2026-006-AWS/

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Third Party Advisory

https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Timeline

No history available yet.