CVE-2026-3494

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3494
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3494.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3494
Aliases
Downstream
Related
Published
2026-03-03T18:12:12.361Z
Modified
2026-07-08T08:12:27.235201763Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
MariaDB Server Audit Plugin Comment Handling Bypass
Details

In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL, QUERYDDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-778"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3494.json"
}
References

Affected packages

Git / github.com/aws/audit-plugin-for-mysql

Affected ranges

Type
GIT
Repo
https://github.com/aws/audit-plugin-for-mysql
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
01e25a5cb1073f131eea774c06c8a056b1e4b2ff
Database specific 
{
    "source": "REFERENCES"
}
Type
GIT
Repo
https://github.com/mariadb/server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
8f0c9340537b84fcd7012d4a31e6f858e7eb919c
Fixed
635559a2ad68a5a6d1a354e8209c58323dba0261
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.6.24"
        },
        {
            "introduced": "10.7.0"
        },
        {
            "last_affected": "10.11.15"
        },
        {
            "introduced": "11.0.0"
        },
        {
            "last_affected": "11.4.9"
        },
        {
            "introduced": "11.5.0"
        },
        {
            "last_affected": "11.8.5"
        }
    ],
    "cpe": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

mariadb-10.*
mariadb-10.1.0
mariadb-10.1.2
mariadb-10.1.3
mariadb-10.1.4
mariadb-10.1.5
mariadb-10.1.6
mariadb-10.1.7
mariadb-10.1.8
mariadb-10.2.0
mariadb-10.2.1
mariadb-10.2.2
mariadb-10.3.0
mariadb-10.3.1
mariadb-10.3.2
mariadb-10.3.4
mariadb-10.3.5
mariadb-10.3.6
mariadb-10.4.3
mariadb-10.4.4
mariadb-10.5.0
mariadb-10.5.2
mariadb-10.6.0
mariadb-10.6.1
mariadb-10.6.10
mariadb-10.6.11
mariadb-10.6.12
mariadb-10.6.13
mariadb-10.6.14
mariadb-10.6.16
mariadb-10.6.17
mariadb-10.6.18
mariadb-10.6.19
mariadb-10.6.2
mariadb-10.6.20
mariadb-10.6.21
mariadb-10.6.22
mariadb-10.6.23
mariadb-10.6.24
mariadb-10.6.3
mariadb-10.6.4
mariadb-10.6.5
mariadb-10.6.6
mariadb-10.6.8
mariadb-10.6.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3494.json"