Skip to content
OpenAdvisories
High · 8.4 CVE-2026-107814 EUVD-2026-95899

MariaDB: Insecure $HOME in MariaDB rpm packages

Published Oct 9, 2026 · Updated Oct 9, 2026 · Assigned by GitHub_M

Vendor: MariaDB Product: server Package: mariadb Package: mariadb-10.0 Package: mariadb-10.1 Package: mariadb-10.3 Package: mariadb-10.6 Ecosystem: Ubuntu

Description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Affected products

VendorProductAffectedFixed
MariaDB server >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 mariadb No fix yet —
Ubuntu 26.04 LTS mariadb No fix yet —
Ubuntu 24.04 LTS mariadb No fix yet —
Ubuntu 22.04 LTS mariadb-10.6 No fix yet —
Ubuntu 20.04 LTS mariadb-10.3 No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS mariadb-10.1 No fix yet —
Ubuntu 16.04 LTS mariadb-10.0 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 mariadb10.11 +19 10.11.18-4.1.hum1 RHSA-2026:84701, RHSA-2026:83108
Red Hat Hardened Images 1 mariadb11.8 +20 3:11.8.9-0.1.hum1 RHSA-2026:84689

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed mariadb 12.3.2-3.1 openSUSE-SU-2026:12245-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 mariadb1011 +15 3:10.11.19-1.amzn2023.0.2 ALAS2023-2026-3289
Amazon Linux 2023 mariadb114 +15 3:11.4.13-1.amzn2023.0.2 ALAS2023-2026-3288
Amazon Linux 2023 mariadb118 +15 3:11.8.9-1.amzn2023.0.2 ALAS2023-2026-3287
Amazon Linux 2023 mariadb123 +15 3:12.3.3-2.amzn2023.0.2 ALAS2023-2026-3286
Amazon Linux 2 mariadb +7 1:5.5.68-1.amzn2.0.4 ALAS2-2026-4028

Advisories 10

References