CVE-2026-107818: 
MariaDB Server Análisis y mitigación de vulnerabilidades

CVE-2026-107818 is an environment injection vulnerability in MariaDB Server affecting the mariadb.service systemd unit file, classified as "environment injection via wsrep bootstrap." A database user with FILE privilege and a permissive secure-file-priv configuration allowing writes to /run/mysqld can create the file /run/mysqld/wsrep-new-cluster, injecting attacker-controlled environment variables into the MariaDB service upon its next restart. Affected versions span 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, and 13.0.1. The vulnerability was published on October 9, 2026, and carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-15 (External Control of System or Configuration Setting): the mariadb.service systemd unit used an EnvironmentFile directive pointing to /run/mysqld/wsrep-new-cluster, a path writable by the mysql OS user when secure-file-priv permits writes there. An authenticated database user with the FILE privilege could use SELECT ... INTO OUTFILE to write arbitrary key-value pairs into that file, which systemd would then parse as environment variables when the service restarted. The fix relocates the environment file to /run/mariadb-wsrep-new-cluster (owned by root, not writable by the mysql user), removes the wsrep-start-position environment file mechanism entirely, and delegates cleanup of the file to the galera_new_cluster script rather than the service itself (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated database attacker to inject arbitrary environment variables into the MariaDB service process at restart, potentially achieving privilege escalation to the permissions of the restarted service (typically the mysql system user or higher, depending on systemd configuration). The scope change reflected in the CVSS score indicates that the impact crosses the security boundary from the database layer into the host OS service environment, with high confidentiality, integrity, and availability impact. Depending on which environment variables are injected (e.g., LD_PRELOAD, PATH), an attacker could achieve arbitrary code execution within the service context, access sensitive data, or disrupt service availability (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). Exploitation requires an authenticated database account with the FILE privilege and a secure-file-priv setting that permits writes to /run/mysqld, limiting the attack surface to misconfigured or overly permissive deployments. The EPSS score is currently 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was discovered and reported by Vincent55 Yang via the Webpros (cPanel/Plesk) security team (GitHub Advisory).

1. Reconnaissance: Identify a MariaDB server instance running a vulnerable version (10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, or 13.0.1) on Linux with systemd.
2. Verify preconditions: Confirm the attacker's database account has the FILE privilege (SHOW GRANTS;) and that secure_file_priv is set to a value permitting writes to /run/mysqld (e.g., SHOW VARIABLES LIKE 'secure_file_priv';).
3. Craft malicious environment file: Construct a payload containing attacker-controlled environment variable assignments, such as LD_PRELOAD=/tmp/evil.so or PATH=/tmp:$PATH, formatted as a systemd EnvironmentFile (one KEY=VALUE per line).
4. Write the file: Execute a SQL statement to write the payload to the target path: SELECT '_WSREP_NEW_CLUSTER=--wsrep-new-cluster\nLD_PRELOAD=/tmp/evil.so' INTO OUTFILE '/run/mysqld/wsrep-new-cluster';
5. Trigger service restart: Wait for or socially engineer an administrator to restart the mariadb.service (e.g., during routine maintenance), or exploit another vulnerability to trigger a restart.
6. Achieve elevated execution: Upon restart, systemd reads the malicious EnvironmentFile and passes the injected variables to the mariadbd process, executing attacker-controlled code or altering service behavior with the service's OS-level permissions (GitHub Advisory, Fix Commit).

• File System: Presence of an unexpected or recently modified file at /run/mysqld/wsrep-new-cluster containing entries beyond _WSREP_NEW_CLUSTER=--wsrep-new-cluster; suspicious files in /run/mysqld/ created by the mysql OS user.
• Logs: MariaDB general query log entries showing SELECT ... INTO OUTFILE '/run/mysqld/wsrep-new-cluster' or similar write operations to /run/mysqld/; systemd journal entries (journalctl -u mariadb) showing unexpected environment variables loaded at service start.
• Process: Unusual child processes or shared libraries loaded by mariadbd after a restart (e.g., unexpected LD_PRELOAD libraries visible via /proc/<pid>/maps); unexpected network connections originating from the mariadbd process.
• Database: Audit log entries showing FILE privilege usage by non-administrative accounts; queries writing to paths under /run/mysqld/ (GitHub Advisory).

Upgrade MariaDB Server to the patched versions: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 (GitHub Advisory). As an immediate workaround prior to patching: (1) ensure secure-file-priv does not permit writes to /run/mysqld or any sensitive system directory, and (2) revoke the FILE privilege from all database accounts that do not strictly require it (REVOKE FILE ON *.* FROM 'user'@'host';). Additionally, monitor /run/mysqld/ for unexpected file creation by database processes as a detective control.

The vulnerability was discovered by Vincent55 Yang via the Webpros (cPanel/Plesk) security team, suggesting it may have been identified in the context of shared hosting environments where MariaDB FILE privilege misuse is a known risk vector (GitHub Advisory). Red Hat has tracked the issue and published a CVE advisory page, indicating downstream Linux distribution impact is being assessed (Red Hat CVE). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time.