CVE-2026-85985: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-85985 is an authorization bypass vulnerability in MariaDB Server's CONNECT engine plugin, allowing low-privileged authenticated attackers to read or write arbitrary files on the server filesystem by exploiting file-access UDFs that fail to enforce the FILE privilege or secure_file_priv setting. The affected UDFs are json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file(). Affected versions span multiple branches: 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, and 13.0.1. The vulnerability was reported by Duong Tran from CyStack, published as a GitHub Security Advisory on September 7, 2026, and assigned a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is missing authorization (CWE-862) combined with files or directories accessible to external parties (CWE-552): the CONNECT engine's file-access UDFs (json_file, bson_file, jfile_make, bfile_make, jbin_file) did not call check_global_access() to verify the FILE_ACL privilege, nor did they invoke is_secure_file_path() to validate paths against the secure_file_priv setting before performing filesystem operations. The fix introduced a new connect_can_access_file() helper function in storage/connect/filechk.cpp that enforces both checks — verifying FILE_ACL for the current session and resolving the real path against secure_file_priv using fn_format() with MY_SAFE_PATH — and inserted calls to this function at the start of each affected UDF body (GitHub Commit). An attacker with any low-privileged database account and network access to the MariaDB instance can exploit this by simply calling one of the affected UDFs with an arbitrary filesystem path as an argument (GitHub Advisory).

A low-privileged authenticated attacker can read sensitive files accessible to the MariaDB OS account (e.g., configuration files, credentials, application data) or write arbitrary content to writable paths, bypassing the FILE privilege and secure_file_priv restrictions that are specifically designed to prevent such access. The confidentiality and integrity impacts are both rated Low in scope (unchanged), meaning the attacker is constrained by OS-level file permissions of the database process account, but this can still expose sensitive server-side data or allow data tampering. There is no direct availability impact, but successful exploitation could facilitate credential theft or configuration manipulation that enables further lateral movement (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. NVD's SSVC assessment classifies exploitation as "none" and automation as "no," indicating the attack requires authenticated access and manual invocation of the affected UDFs. No threat actor attribution has been reported.

1. Gain database access: Obtain any low-privileged MariaDB account with network access to the target server (e.g., a SELECT-only account). No FILE privilege is required.
2. Verify CONNECT plugin availability: Confirm the CONNECT engine and its UDFs are installed by running SHOW PLUGINS; and checking for CONNECT, or by attempting SELECT json_file('/etc/hostname');.
3. Read arbitrary files: Call a file-read UDF with a target filesystem path readable by the MariaDB OS account, e.g.:

   SELECT json_file('/etc/passwd');
   SELECT bson_file('/home/mysql/.my.cnf');
   SELECT jbin_file('/var/lib/mysql-files/sensitive_data.json');

4. Write arbitrary files: Use a file-write UDF to place attacker-controlled content at a writable path, e.g.:

   SELECT jfile_make('{"malicious":"payload"}', '/tmp/output.json', 0);
   SELECT bfile_make('{"key":"value"}', '/var/lib/mysql/injected.json', 0);

5. Exfiltrate or leverage data: Retrieve the returned file contents from the SQL result set, or use written files to stage further attacks (e.g., overwriting configuration files if permissions allow) (GitHub Advisory, GitHub Commit).

• Logs: MariaDB general query log entries showing calls to json_file(), bson_file(), jfile_make(), bfile_make(), or jbin_file() with filesystem paths outside secure_file_priv by users without the FILE privilege; absence of Access denied warnings in the query log on unpatched systems where such calls succeed.
• Logs: MariaDB error log entries with Warning 1105 Access denied: FILE privilege or secure_file_priv violation (on patched systems, indicating attempted exploitation).
• Network: SQL queries over the MariaDB port (default 3306/TCP) from unexpected source IPs invoking CONNECT file UDFs with sensitive path arguments (detectable via network-level SQL inspection or database activity monitoring).
• File System: Unexpected new or modified files in directories writable by the MariaDB OS account (e.g., /tmp/, /var/lib/mysql/, application directories) with timestamps correlating to database session activity.
• File System: Unexpected reads of sensitive files (e.g., /etc/passwd, .my.cnf, application config files) by the mysqld process, detectable via OS-level file auditing (e.g., auditd with -w /etc/passwd -p r).

Upgrade MariaDB Server to a patched release: 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2 depending on your branch (GitHub Advisory). If immediate patching is not possible, apply one of the following workarounds: (1) uninstall the CONNECT engine plugin entirely if it is not needed (UNINSTALL PLUGIN CONNECT;), or (2) if the CONNECT engine is required but the file-access UDFs are not, drop those specific UDFs (DROP FUNCTION json_file; DROP FUNCTION bson_file; etc.). Additionally, review and restrict database user privileges, ensuring that only accounts that genuinely require file access are granted the FILE privilege, and configure secure_file_priv to a restrictive directory (Red Hat CVE).

The vulnerability was credited to Duong Tran from CyStack, who reported it responsibly to the MariaDB project (GitHub Advisory). Red Hat has tracked the issue in their security advisory system (Red Hat CVE). No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been observed at this time.