MariaDB 11.8.5 Audit Plugin: Double-Hyphen Comments Not Logged
CVE-2026-3494 Published on March 3, 2026

MariaDB Server Audit Plugin Comment Handling Bypass
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen () or hash (#) style comments, the statement is not logged.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-3494 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

Insufficient Logging

When a security-critical event occurs, the software either does not record the event or omits important details about the event when logging it. When security-critical events are not logged properly, such as a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analysis after an attack succeeds.


Products Associated with CVE-2026-3494

Want to know whenever a new CVE is published for Amazon Aws? stack.watch will email you.

Amazon Aws
 

Affected Versions

MariaDB Foundation MariaDB Server: Amazon Aurora MySQL: Amazon RDS for MySQL: Amazon RDS for MariaDB: