CVE-2026-61700: 
Java vulnerability analysis and mitigation

CVE-2026-61700 is a file disclosure vulnerability in MariaDB Connector/J (the Java JDBC driver for MariaDB and MySQL databases) caused by improper enforcement of the allowLocalInfile=false configuration option. The ClientMessage.readPacket method processes server-initiated LOCAL INFILE protocol packets (type 0xfb) without checking whether local infile access has been disabled, allowing a rogue or man-in-the-middle server to receive file contents the application intended to load. Affected versions include all releases prior to 2.7.14, 3.3.5 (in the 3.0.x–3.3.x range), 3.4.3 (in the 3.4.x range), and 3.5.9 (in the 3.5.x range). The vulnerability was reported by researcher tharavel, first published to the GitHub Advisory Database on July 10, 2026, and formally disclosed on September 17, 2026. It carries a CVSS v3.1 base score of 3.7 (Low) (Github Advisory).

The root cause is classified as CWE-284 (Improper Access Control): the ClientMessage.readPacket method in src/main/java/org/mariadb/jdbc/message/ClientMessage.java fails to check the allowLocalInfile configuration flag before processing a server-sent 0xfb LOCAL INFILE request packet (Github Advisory). When a Java application issues a LOAD DATA LOCAL INFILE '/path/to/file' COM_QUERY, the filename is transmitted to the server as part of the query; a rogue or MitM server can then respond with a 0xfb packet echoing that exact filename, causing the connector to transmit the file's contents despite allowLocalInfile=false being set (Github Advisory). Critically, the attacker is constrained to the filename already chosen by the application — arbitrary path redirection (e.g., to /etc/passwd) is not possible unless the application itself targets such files. The fix, applied in commit 0205d8b, adds an explicit check for context.getConf().allowLocalInfile() before any filename validation, immediately rejecting the server's request with an error when the option is disabled (Patch Commit).

Successful exploitation results in limited confidentiality impact: a rogue or MitM database server can receive the contents of the specific file an application is loading via LOAD DATA LOCAL INFILE, bypassing the allowLocalInfile=false defense-in-depth control. There is no integrity or availability impact. The practical risk is confined to applications that actively use LOAD DATA LOCAL INFILE on sensitive files (e.g., credentials, configuration exports) over untrusted network connections — a relatively narrow attack surface (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the disclosure date (Github Advisory). The EPSS score is 0.0, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a high-complexity attack scenario: the attacker must control a rogue database server or occupy a man-in-the-middle position on the network, and the target application must actively use LOAD DATA LOCAL INFILE on sensitive data over an untrusted connection (Github Advisory).

1. Prerequisite — Position: Attain a man-in-the-middle position on the network path between the Java application and its MariaDB/MySQL server, or operate a rogue database server that the application connects to (e.g., via DNS spoofing, ARP poisoning, or misconfigured connection strings).
2. Identify target application: Confirm the application uses LOAD DATA LOCAL INFILE queries and connects with a vulnerable version of MariaDB Connector/J (< 2.7.14, 3.0.x–3.3.4, 3.4.0–3.4.2, or 3.5.0–3.5.8) with allowLocalInfile=false set as a supposed safeguard.
3. Intercept or receive the COM_QUERY: Wait for the application to issue a LOAD DATA LOCAL INFILE '/path/to/sensitive/file' query. The filename is transmitted in plaintext as part of the COM_QUERY packet (unless TLS is enforced).
4. Respond with a 0xfb packet: Reply to the connector with a MySQL/MariaDB protocol 0xfb LOCAL INFILE request packet echoing the exact filename received from the application's query.
5. Receive file contents: The vulnerable connector, without checking allowLocalInfile, reads the local file and transmits its contents to the attacker-controlled server, completing the file disclosure (Github Advisory).

• Network: Unencrypted database connections (no TLS/SSL) between the Java application and the database server, particularly over untrusted or public networks; unexpected 0xfb protocol packets in database traffic captures.
• Logs: Application-level SQL audit logs showing LOAD DATA LOCAL INFILE queries targeting sensitive file paths (e.g., configuration files, credential stores, data exports); after patching, error messages such as "Server asked for a local infile for file '...' while allowLocalInfile is disabled. Possible malicious server." in application logs indicate exploitation attempts were blocked.
• Network: Connections to unexpected or newly observed database server IP addresses that may indicate DNS spoofing or connection redirection to a rogue server.

Upgrade MariaDB Connector/J to one of the patched versions: 2.7.14, 3.3.5, 3.4.3, or 3.5.9 (Github Advisory, Release Notes). As interim mitigations: enforce TLS/SSL on all database connections to prevent man-in-the-middle interception; avoid using LOAD DATA LOCAL INFILE over untrusted network connections; and if the feature is not required, disable it entirely at the application level rather than relying solely on allowLocalInfile=false. Applications that do not use LOAD DATA LOCAL INFILE at all are not at risk from this vulnerability.

HeroDevs published a blog post covering CVE-2026-61700 alongside related MariaDB Connector CVEs in the context of Spring Boot applications, noting the practical constraints on exploitation (HeroDevs Blog). General community sentiment reflects the low severity rating, with commentary emphasizing that the narrow exploitation prerequisites (MitM position plus active use of LOAD DATA LOCAL INFILE on sensitive files) significantly limit real-world risk.