CVE-2026-3494: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-3494 is an audit logging bypass vulnerability in MariaDB Server's server audit plugin, classified as Insufficient Logging (CWE-778). When the audit plugin is enabled with server_audit_events configured to filter QUERY_DCL, QUERY_DDL, or QUERY_DML events, SQL statements prefixed with double-hyphen (--) or hash (#) style comments are silently skipped and not recorded in the audit log. The vulnerability affects MariaDB Server through version 11.8.5, as well as Amazon RDS for MariaDB, Amazon RDS for MySQL, and Amazon Aurora MySQL across multiple version ranges. It was published on March 3, 2026, with a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (AWS Security Bulletin, MSRC Advisory).

The root cause lies in the audit plugin's own simple SQL parser, which incorrectly handled SQL comment prefixes (-- and #) when determining the statement type for event filtering. Because the plugin's internal parser — rather than the server's authoritative SQL command classification — was used to categorize queries, statements beginning with these comment styles were misclassified and excluded from logging. The fix, tracked as MDEV-38375, removes the plugin's custom parser entirely and replaces it with a call to thd_sql_command(thd), which uses the server's own command classification (MariaDB Commit, AWS Audit Plugin Commit). Exploitation requires only a low-privileged, authenticated database account and no user interaction, making it straightforward for any database user to abuse.

Successful exploitation allows an authenticated database user to execute DDL, DML, or DCL SQL statements — including potentially sensitive operations such as data modification, privilege grants, or schema changes — without those actions appearing in the audit log. This undermines compliance and forensic capabilities, as security teams and auditors cannot rely on the audit trail to detect unauthorized or malicious database activity. The integrity impact is low in terms of direct data modification, but the audit evasion capability significantly increases the risk of undetected insider threats or post-compromise lateral movement within the database environment (AWS Security Bulletin).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-3494 as of the available data. A GitHub repository named KKongTen/CVE-2026-3494 appeared in June 2026, which may contain a proof-of-concept, but no confirmed weaponization or threat actor attribution has been identified. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (AWS Security Bulletin).

1. Authenticate to the database: Obtain any valid low-privileged database account on a MariaDB server (or Amazon RDS/Aurora instance) where the server audit plugin is enabled with server_audit_events set to include QUERY_DCL, QUERY_DDL, or QUERY_DML.
2. Craft a comment-prefixed SQL statement: Prepend the target SQL statement with a double-hyphen (-- ) or hash (#) comment before the actual command, for example: -- comment DROP TABLE sensitive_data; or # bypass GRANT ALL ON db.* TO attacker@'%';.
3. Execute the statement: Submit the crafted statement to the MariaDB server. The server executes the SQL normally, but the audit plugin's internal parser misclassifies the statement type due to the leading comment and omits it from the audit log.
4. Verify audit evasion: Confirm that the executed statement does not appear in the server audit log, allowing the action to proceed without a recorded trace (MariaDB Commit, AWS Security Bulletin).

• Logs: Gaps or inconsistencies in the MariaDB server audit log — particularly missing entries for DDL, DML, or DCL operations that are known to have occurred (e.g., schema changes visible in information_schema but absent from audit logs).
• Database State: Unexpected schema changes, new user accounts, modified privileges, or altered data that cannot be correlated to audit log entries.
• Query Patterns: Review of general query logs (if enabled separately from the audit plugin) for SQL statements beginning with -- or # comment prefixes followed by DDL/DML/DCL commands.
• File System: Presence of a GitHub repository or script files referencing CVE-2026-3494 on systems used by database administrators, potentially indicating reconnaissance or testing activity.

Upgrade to a patched version as the primary remediation — no known workarounds exist. Fixed versions include: MariaDB Server (patches available via SUSE SU-2026:2282-1 and SU-2026:2330-1, and Amazon Linux 2023 ALAS2023-2026-1811); Amazon RDS for MariaDB (10.6.25, 10.11.16, 11.4.10, 11.8.6); Amazon RDS for MySQL (5.7.44-RDS.20260212, 8.0.45, 8.4.8); Amazon Aurora MySQL (2.12.6, 3.04.6, 3.10.3, 3.11.1). Microsoft has also released patched packages for CBL-Mariadb (10.6.24-1) and AZL3 (10.11.15-1). Organizations should prioritize upgrading managed database instances and any self-hosted MariaDB deployments, and verify audit log completeness after patching (AWS Security Bulletin, MSRC Advisory, SUSE Advisory).

Amazon Web Services published a security bulletin (2026-006-AWS) on March 3, 2026, identifying and disclosing the vulnerability as the assigning CNA. Microsoft included CVE-2026-3494 in its March 2026 Patch Tuesday update cycle, which was covered by outlets including BleepingComputer and Lansweeper. SUSE issued security advisories (SUSE-SU-2026:2282-1 and SUSE-SU-2026:2330-1) for affected MariaDB packages in May 2026. Community discussion has been limited, consistent with the vulnerability's moderate severity and narrow exploitation preconditions (AWS Security Bulletin, MSRC Advisory).