CVE-2026-3494

Description

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

How to fix CVE-2026-3494

To remediate CVE-2026-3494, upgrade the affected package to a fixed version below.

• Alpine/mariadb—upgrade to 10.11.16-r0 or later
• Bitnami/mariadb—upgrade to 10.6.25 or later
• —upgrade to 10.6.25 or later
• —upgrade to 10.6.25 or later

Is CVE-2026-3494 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 10.11.16-r0
• from 0, < 10.6.25, >= 10.7.0, < 10.11.16, >= 11.0.0, < 11.4.10, >= 11.5.0, < 11.8.6
• from 0, < 10.6.25, >= 10.7.0, < 10.11.16, >= 11.0.0, < 11.4.10, >= 11.5.0, < 11.8.6
• from 0, < 10.6.25, >= 10.7.0, < 12.0.2

CVSS scores

References (5)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-3494
• WEBaws.amazon.com/security/security-bulletins/2026-006-AWS/
• WEBgithub.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff
• WEBgithub.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261