CVE-Katalog
CVE-2026-107814
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account
- Schweregrad
- High · CVSS 8.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.28% · Oct 22, 2026
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | mariadb | sid | 1:11.8.9+ds-4 | not affected |
| Debian | mariadb | forky | 1:11.8.9+ds-2 | not affected |
| Debian | mariadb | trixie | 1:11.8.6-0+deb13u1 | not affected |
| Debian | mariadb | bookworm | 1:10.11.18-0+deb12u1 | not affected |
| Debian | mariadb | bookworm-security | 1:10.11.19-0+deb12u1 | not affected |
| Cpe | mariadb | Not reported | 13.0.2 | fixed |
| Bitnami | mariadb | Not reported | 10.6.28 | fixed |
| Bitnami | mariadb | Not reported | 10.11.19 | fixed |
| Bitnami | mariadb | Not reported | 11.4.13 | fixed |
| Bitnami | mariadb | Not reported | 11.8.9 | fixed |
| Bitnami | mariadb | Not reported | 12.3.3 | fixed |
| Bitnami | mariadb | Not reported | 13.0.2 | fixed |
| Bitnami | mariadb-min | Not reported | 10.6.28 | fixed |
| Bitnami | mariadb-min | Not reported | 10.11.19 | fixed |
| Bitnami | mariadb-min | Not reported | 11.4.13 | fixed |
| Bitnami | mariadb-min | Not reported | 11.8.9 | fixed |
| Bitnami | mariadb-min | Not reported | 12.3.3 | fixed |
| Bitnami | mariadb-min | Not reported | 13.0.2 | fixed |
| Bitnami | mysql-client | Not reported | 10.6.28 | fixed |
| Bitnami | mysql-client | Not reported | 10.11.19 | fixed |
| Bitnami | mysql-client | Not reported | 11.4.13 | fixed |
| Bitnami | mysql-client | Not reported | 11.8.9 | fixed |
| Bitnami | mysql-client | Not reported | 12.3.3 | fixed |
| Bitnami | mysql-client | Not reported | 13.0.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | mariadb | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | mariadb | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | mariadb | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | mariadb | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Cpe | mariadb | cpe | Not reported | 13.0.2 | Not reported | NVD-CVE-2026-107814 | Not reported |
| Bitnami | mariadb | Bitnami | Not reported | 10.6.28 | Not reported | BIT-MARIADB-2026-107814 | Not reported |
| Bitnami | mariadb | Bitnami | Not reported | 10.11.19 | Not reported | BIT-MARIADB-2026-107814 | Not reported |
| Bitnami | mariadb | Bitnami | Not reported | 11.4.13 | Not reported | BIT-MARIADB-2026-107814 | Not reported |
| Bitnami | mariadb | Bitnami | Not reported | 11.8.9 | Not reported | BIT-MARIADB-2026-107814 | Not reported |
| Bitnami | mariadb | Bitnami | Not reported | 12.3.3 | Not reported | BIT-MARIADB-2026-107814 | Not reported |
| Bitnami | mariadb | Bitnami | Not reported | 13.0.2 | Not reported | BIT-MARIADB-2026-107814 | Not reported |
| Bitnami | mariadb-min | Bitnami | Not reported | 10.6.28 | Not reported | BIT-MARIADB-MIN-2026-107814 | Not reported |
| Bitnami | mariadb-min | Bitnami | Not reported | 10.11.19 | Not reported | BIT-MARIADB-MIN-2026-107814 | Not reported |
| Bitnami | mariadb-min | Bitnami | Not reported | 11.4.13 | Not reported | BIT-MARIADB-MIN-2026-107814 | Not reported |
| Bitnami | mariadb-min | Bitnami | Not reported | 11.8.9 | Not reported | BIT-MARIADB-MIN-2026-107814 | Not reported |
| Bitnami | mariadb-min | Bitnami | Not reported | 12.3.3 | Not reported | BIT-MARIADB-MIN-2026-107814 | Not reported |
| Bitnami | mariadb-min | Bitnami | Not reported | 13.0.2 | Not reported | BIT-MARIADB-MIN-2026-107814 | Not reported |
| Bitnami | mysql-client | Bitnami | Not reported | 10.6.28 | Not reported | BIT-MYSQL-CLIENT-2026-107814 | Not reported |
| Bitnami | mysql-client | Bitnami | Not reported | 10.11.19 | Not reported | BIT-MYSQL-CLIENT-2026-107814 | Not reported |
| Bitnami | mysql-client | Bitnami | Not reported | 11.4.13 | Not reported | BIT-MYSQL-CLIENT-2026-107814 | Not reported |
| Bitnami | mysql-client | Bitnami | Not reported | 11.8.9 | Not reported | BIT-MYSQL-CLIENT-2026-107814 | Not reported |
| Bitnami | mysql-client | Bitnami | Not reported | 12.3.3 | Not reported | BIT-MYSQL-CLIENT-2026-107814 | Not reported |
| Bitnami | mysql-client | Bitnami | Not reported | 13.0.2 | Not reported | BIT-MYSQL-CLIENT-2026-107814 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libmariadb3]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [libmariadbd19]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [libmariadbd-dev]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [libmariadb-dev]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [libmariadb-dev-compat]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-backup]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-client]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-client-core]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-common]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· all · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· all · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-connect]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-cracklib-password-check]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-gssapi-client]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-gssapi-server]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-hashicorp-key-management]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-mroonga]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-oqgraph]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-provider-bzip2]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-provider-lz4]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-provider-lzma]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
- [mariadb-plugin-provider-lzo]Nicht betroffen
Quellpaket: [mariadb]
Details (2)
1:10.11.18-0+deb12u1· amd64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
1:10.11.18-0+deb12u1· arm64 · bookwormNicht betroffen
nvd · mariadb · debian · bookworm
Beobachtet:
Referenzen
- [https://access.redhat.com/errata/RHSA-2026:83108]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-107814]
- [https://osv.dev/vulnerability/CVE-2026-107814]
- [https://security-tracker.debian.org/tracker/CVE-2026-107814]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3856.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]