Catalogo CVE

CVE-2026-107818

Gravità: High · CVSS 8.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Published: Oct 9, 2026, 5:23:58 PM UTC
Updated: Oct 9, 2026, 6:17:03 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.34% · Oct 22, 2026

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	mariadb	sid	`1:11.8.9+ds-4`	fixed
Debian	mariadb	forky	`1:11.8.9+ds-2`	fixed
Debian	mariadb	trixie	`1:11.8.6-0+deb13u1`	vulnerable
Debian	mariadb	bookworm	`1:10.11.18-0+deb12u1`	vulnerable
Debian	mariadb	bookworm-security	`1:10.11.19-0+deb12u1`	vulnerable
Cpe	mariadb	Not reported	`13.0.2`	fixed
Bitnami	mariadb	Not reported	`10.6.28`	fixed
Bitnami	mariadb	Not reported	`10.11.19`	fixed
Bitnami	mariadb	Not reported	`11.4.13`	fixed
Bitnami	mariadb	Not reported	`11.8.9`	fixed
Bitnami	mariadb	Not reported	`12.3.3`	fixed
Bitnami	mariadb	Not reported	`13.0.2`	fixed
Bitnami	mariadb-min	Not reported	`10.6.28`	fixed
Bitnami	mariadb-min	Not reported	`10.11.19`	fixed
Bitnami	mariadb-min	Not reported	`11.4.13`	fixed
Bitnami	mariadb-min	Not reported	`11.8.9`	fixed
Bitnami	mariadb-min	Not reported	`12.3.3`	fixed
Bitnami	mariadb-min	Not reported	`13.0.2`	fixed
Bitnami	mysql-client	Not reported	`10.6.28`	fixed
Bitnami	mysql-client	Not reported	`10.11.19`	fixed
Bitnami	mysql-client	Not reported	`11.4.13`	fixed
Bitnami	mysql-client	Not reported	`11.8.9`	fixed
Bitnami	mysql-client	Not reported	`12.3.3`	fixed
Bitnami	mysql-client	Not reported	`13.0.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	mariadb	source	sid	`1:11.8.9+ds-1`	not yet assigned	Not reported	Not reported
Debian	mariadb	source	forky	`1:11.8.9+ds-1`	not yet assigned	Not reported	Not reported
Debian	mariadb	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	mariadb	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`13.0.2`	Not reported	NVD-CVE-2026-107818	Not reported
Bitnami	mariadb	Bitnami	Not reported	`10.6.28`	Not reported	BIT-MARIADB-2026-107818	Not reported
Bitnami	mariadb	Bitnami	Not reported	`10.11.19`	Not reported	BIT-MARIADB-2026-107818	Not reported
Bitnami	mariadb	Bitnami	Not reported	`11.4.13`	Not reported	BIT-MARIADB-2026-107818	Not reported
Bitnami	mariadb	Bitnami	Not reported	`11.8.9`	Not reported	BIT-MARIADB-2026-107818	Not reported
Bitnami	mariadb	Bitnami	Not reported	`12.3.3`	Not reported	BIT-MARIADB-2026-107818	Not reported
Bitnami	mariadb	Bitnami	Not reported	`13.0.2`	Not reported	BIT-MARIADB-2026-107818	Not reported
Bitnami	mariadb-min	Bitnami	Not reported	`10.6.28`	Not reported	BIT-MARIADB-MIN-2026-107818	Not reported
Bitnami	mariadb-min	Bitnami	Not reported	`10.11.19`	Not reported	BIT-MARIADB-MIN-2026-107818	Not reported
Bitnami	mariadb-min	Bitnami	Not reported	`11.4.13`	Not reported	BIT-MARIADB-MIN-2026-107818	Not reported
Bitnami	mariadb-min	Bitnami	Not reported	`11.8.9`	Not reported	BIT-MARIADB-MIN-2026-107818	Not reported
Bitnami	mariadb-min	Bitnami	Not reported	`12.3.3`	Not reported	BIT-MARIADB-MIN-2026-107818	Not reported
Bitnami	mariadb-min	Bitnami	Not reported	`13.0.2`	Not reported	BIT-MARIADB-MIN-2026-107818	Not reported
Bitnami	mysql-client	Bitnami	Not reported	`10.6.28`	Not reported	BIT-MYSQL-CLIENT-2026-107818	Not reported
Bitnami	mysql-client	Bitnami	Not reported	`10.11.19`	Not reported	BIT-MYSQL-CLIENT-2026-107818	Not reported
Bitnami	mysql-client	Bitnami	Not reported	`11.4.13`	Not reported	BIT-MYSQL-CLIENT-2026-107818	Not reported
Bitnami	mysql-client	Bitnami	Not reported	`11.8.9`	Not reported	BIT-MYSQL-CLIENT-2026-107818	Not reported
Bitnami	mysql-client	Bitnami	Not reported	`12.3.3`	Not reported	BIT-MYSQL-CLIENT-2026-107818	Not reported
Bitnami	mysql-client	Bitnami	Not reported	`13.0.2`	Not reported	BIT-MYSQL-CLIENT-2026-107818	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libmariadb3]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[libmariadbd19]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[libmariadbd-dev]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[libmariadb-dev]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[libmariadb-dev-compat]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-backup]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-client]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-client-core]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-common]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · all · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · all · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-connect]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-cracklib-password-check]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-gssapi-client]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-gssapi-server]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-hashicorp-key-management]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-mroonga]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-oqgraph]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-provider-bzip2]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-provider-lz4]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-provider-lzma]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
[mariadb-plugin-provider-lzo]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:10.11.18-0+deb12u1 · amd64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm
- 1:10.11.18-0+deb12u1 · arm64 · bookworm
  Interessata
  nvd · mariadb · debian · bookworm

Altri risultati

Osservato: Oct 23, 2026, 7:39:39 PM UTC

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]