Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

MariaDB RPM allows code execution via mysql account

CVE-2026-107814 · published 26 days ago
Summary

Certain MariaDB RPM packages set the database’s data folder as the home directory for the mysql service account. A database user who has permission to write files can place a startup script there, which could run automatically when an administrator opens a shell for that account. Upgrade to the latest MariaDB versions listed in the release notes to eliminate the risk.

What to do
  • Update bellsoft mariadb to version 10.6.28-r0.
  • Update bellsoft mariadb to version 11.4.13-r0.
  • Update bellsoft mariadb to version 11.8.9-r0.
  • Update mariadb to version 13.0.2.
  • Update mariadb-min to version 13.0.2.
  • Update mysql-client to version 13.0.2.
Affected software
Ecosystem VendorProductAffected versions
– mariadb server >= 10.6.1, < 10.6.28
Ubuntu:14.04:LTS canonical mysql-5.5 All versions
Ubuntu:Pro:16.04:LTS canonical mysql-5.7 All versions
Ubuntu:16.04:LTS canonical mariadb-10.0 All versions
Ubuntu:16.04:LTS canonical percona-server-5.6 All versions
Ubuntu:16.04:LTS canonical percona-xtradb-cluster-5.6 All versions
Ubuntu:18.04:LTS canonical mariadb-10.1 All versions
Ubuntu:Pro:20.04:LTS canonical mysql-8.0 All versions
Ubuntu:20.04:LTS canonical mariadb-10.3 All versions
Ubuntu:22.04:LTS canonical mariadb-10.6 All versions
Ubuntu:24.04:LTS canonical mariadb All versions
Ubuntu:26.04:LTS canonical mysql-8.4 All versions
– mariadb mariadb >= 10.6.1, < 10.6.28
>= 10.11.1, < 10.11.19
>= 11.4.1, < 11.4.13
>= 11.8.1, < 11.8.9
>= 12.3.1, < 12.3.3
>= 13.0.1, < 13.0.2
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Alpaquita:23 bellsoft mariadb >= 10.6.12-r0, < 10.6.28-r0
Fix: upgrade to 10.6.28-r0
Alpaquita:25 bellsoft mariadb >= 11.4.5-r0, < 11.4.13-r0
Fix: upgrade to 11.4.13-r0
Alpaquita:stream bellsoft mariadb >= 10.11.4-r0, < 11.8.9-r0
Fix: upgrade to 11.8.9-r0
Bitnami – mariadb >= 13.0.1, < 13.0.2
Fix: upgrade to 13.0.2
Bitnami – mariadb-min >= 13.0.1, < 13.0.2
Fix: upgrade to 13.0.2
Bitnami – mysql-client >= 13.0.1, < 13.0.2
Fix: upgrade to 13.0.2
Original advisory text
MariaDB: Insecure $HOME in MariaDB rpm packages
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published9 Oct 2026
Updated4 Nov 2026
First seen9 Oct 2026
Sources
CVE-2026-107814 · NVD
CVE-2026-107814 · MITRE
UBUNTU-CVE-2026-107814 · OSV
CVE-2026-107814 · OSV
GHSA-m5gf-432r-g5jw · GHSA
BELL-CVE-2026-107814 · OSV
BIT-mysql-client-2026-107814 · OSV
Track software like this
Free during beta