CVE-2026-61700 mariadb-corporation CVE debrief

Who should care

Defenders and developers who use MariaDB Connector/J in their applications should assess their exposure and take necessary actions to mitigate the vulnerability. They should prioritize verifying the allowLocalInfile option is set to false and upgrading to a fixed version. Additionally, they should review applications that use MariaDB Connector/J to ensure they do not load sensitive data over untrusted connections.

Why it matters

CVE-2026-61700 is a vulnerability in MariaDB Connector/J that allows a rogue or man-in-the-middle server to echo a filename and cause the connector to transmit that file despite the disabled option allowLocalInfile=false. Defenders should prioritize verifying the allowLocalInfile option is set to false and upgrading to a fixed version.

• Defenders should verify the allowLocalInfile option is set to false to prevent unintended file transmission.
• Upgrading to a fixed version of MariaDB Connector/J can prevent exploitation.
• Reviewing applications that use MariaDB Connector/J is necessary to ensure they do not load sensitive data over untrusted connections.
• Defenders should monitor for potential exploitation attempts and review their inventory of affected systems.

Technical summary

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sends a LOAD DATA LOCAL INFILE COM_QUERY, a rogue or man-in-the-middle server can echo the same filename and cause the connector to transmit that file despite the disabled option.

Defensive priority

Defenders should prioritize verifying the allowLocalInfile option is set to false and upgrading to a fixed version.

Recommended defensive actions

• Verify the allowLocalInfile option is set to false in MariaDB Connector/J configurations.
• Upgrade to MariaDB Connector/J version 2.7.14, 3.3.5, 3.4.3, or 3.5.9 or later.
• Review applications that use MariaDB Connector/J to ensure they do not load sensitive data over untrusted connections.
• Monitor for potential exploitation attempts and review inventory of affected systems.
• Defenders should verify the allowLocalInfile option is set to false to prevent unintended file transmission.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability and its fixes. The vulnerability is caused by ClientMessage.readPacket processing a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. The issue was reported by a researcher and fixed by the vendor. The CVE record and NVD page provide additional details on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.