Vulnerability in MariaDB Server Affects Audit Logging Mechanisms
CVE-2026-3494

5.3MEDIUM

Key Information:

Vendor: Mariadb Foundation
Status: Mariadb Server; Aurora Mysql; Rds For Mysql; Rds For Mariadb
Vendor: CVE Published:; 3 March 2026

🔔 Create Mariadb Foundation Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-3494?

In versions of the MariaDB server up to 11.8.5, a significant issue arises when the server audit plugin is activated with specific filtering settings for DCL, DDL, or DML queries. Authenticated database users can execute SQL statements that bypass the intended audit logs by using comments prefixed with double-hyphen (—) or hash (#). This allows potentially harmful actions to go unrecorded, creating a gap in security oversight and auditing capabilities.

Affected Version(s)

Aurora MySQL 2.12.6

Aurora MySQL 3.04.6

Aurora MySQL 3.10.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-3494
Created by KKongTen