CVE-2026-107818 MariaDB CVE debrief

Who should care

Defenders responsible for MariaDB server deployments, specifically those using versions 10.6.1 through 10.6.28, 10.11.1 through 10.11.19, 11.4.1 through 11.4.13, 11.8.1 through 11.8.9, 12.3.1 through 12.3.3, and 13.0.1 through 13.0.2, should prioritize patching and restricting FILE privilege to necessary users.

Why it matters

CVE-2026-107818 is a high-severity vulnerability in MariaDB server that allows environment injection via wsrep bootstrap in the mariadb.service file. Defenders should prioritize patching vulnerable versions and restricting FILE privilege to necessary users.

• Potential environment injection and privilege escalation
• Possible service disruption or compromise
• Requires verification of vulnerable versions and configurations
• Patching and configuration changes are necessary to mitigate the vulnerability

Technical summary

The mariadb.service unit uses /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue affects MariaDB server versions 10.6.1 through 10.6.28, 10.11.1 through 10.11.19, 11.4.1 through 11.4.13, 11.8.1 through 11.8.9, 12.3.1 through 12.3.3, and 13.0.1 through 13.0.2. Defenders should prioritize patching vulnerable versions and restricting FILE privilege to necessary users.

Defensive priority

Defenders should prioritize patching vulnerable versions of MariaDB server, specifically versions 10.6.1 through 10.6.28, 10.11.1 through 10.11.19, 11.4.1 through 11.4.13, 11.8.1 through 11.8.9, 12.3.1 through 12.3.3, and 13.0.1 through 13.0.2.

Recommended defensive actions

• Patch vulnerable versions of MariaDB server
• Restrict FILE privilege to necessary users
• Configure secure-file-priv to limit write access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the mariadb.service unit using /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.