VULNERABILITY INTELLIGENCE

CVE-2026-3494

CVSS score4.3 MEDIUM
EPSS probability0.30%
CISA KEVNot currently listed
Published2026-03-03
Last modified2026-10-20
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

Weakness classification

  • ff89ba41-3aa1-4d27-914a-91399e9639e5: CWE-778
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references