MariaDB Server: Environment injection via wsrep bootstrap file
Summary
MariaDB Server contains an environment injection flaw in the mariadb.service unit, which loads /run/mysqld/wsrep-new-cluster as an EnvironmentFile on the next service restart. A database user with the FILE privilege and a secure_file_priv setting that allows writes to /run/mysqld can create that file and inject attacker-controlled environment values into the restarted service. The vendor's CVSS 3.1 base score is 8.4 (High), with high privileges and user interaction required. The vendor fixed the issue by no longer creating the file in a path the server can write to.
Affected
- MariaDB Server 10.6.1 to 10.6.27
- MariaDB Server 10.11.1 to 10.11.18
- MariaDB Server 11.4.1 to 11.4.12
- MariaDB Server 11.8.1 to 11.8.8
- MariaDB Server 12.3.1 to 12.3.2
- MariaDB Server 13.0.1
Fixed in
- 10.6.28
- 10.11.19
- 11.4.13
- 11.8.9
- 12.3.3
- 13.0.2
Workaround
- Ensure secure_file_priv does not allow writes to /run/mysqld.
- Revoke the FILE privilege from all accounts that do not need it.
- Note: the default secure_file_priv setting may permit writes to /run/mysqld, so default installations may be exposed until it is changed.
Exploitation
- No exploitation in the wild has been reported in the sources reviewed.
- No public proof of concept was found in the sources reviewed.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS of about 0.0034 according to a secondary source.
Our recommendation
- Update MariaDB to the fixed version for your branch, or install the fixed distribution package once it is available.
- Review accounts with the FILE privilege (for example with SHOW GRANTS) and revoke it where it is not required.
- Restrict secure_file_priv so that it does not allow writes to /run/mysqld.
- Treat this as a medium-urgency patch in the normal update cycle, or sooner if the database host has accounts with untrusted or broad access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mhvc-vqcq-7vq5 github.com
- MDEV-40629 (MariaDB Jira) jira.mariadb.org
- Fix commit e3d62d4 github.com
- MariaDB 10.6.28 release github.com
- MariaDB 10.11.19 release github.com
- MariaDB 11.4.13 release github.com
- MariaDB 11.8.9 release github.com
- Debian Security Tracker CVE-2026-107818 security-tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:40.
Original description (NVD)
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
NVD references (9)
- https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e
- https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
- https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
- https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
- https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
- https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
- https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2
- https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5
- https://jira.mariadb.org/browse/MDEV-40629
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.