medium4.3
CVE-2026-3494
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_…
Impact
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mariadb | Mariadb | through 10.6.24 from 10.7.0 through 10.11.15 from 11.0.0 through 11.4.9 from 11.5.0 through 11.8.5 |
| Amazon | Aurora Mysql | through 2.12.5 from 3.01.0 before 3.04.6 from 3.05.1 through 3.10.2 Version 3.11.0 |
| Amazon | Relational Database Service | through 5.7.44-rds.20251212 through 10.6.24 from 8.0.11 through 8.0.44 from 8.4.3 through 8.4.7 from 10.11.4 through 10.11.15 from 11.4.3 through 11.4.9 |