Is CVE-2026-107814 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107814 being exploited in the wild.

How severe is CVE-2026-107814?

High severity, with a CVSS score of 8.4, published 9 October 2026.

Which products and versions are affected?

MariaDB Server 10.6.1 to 10.6.28, 10.11.1 to 10.11.19, 11.4.0 to 11.4.13, 11.8.0 to 11.8.9, 12.3.0 to 12.3.3, 13.0.0 to 13.0.2 (RPM packages only).

How is CVE-2026-107814 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-107814?

Check whether you run Mariadb or MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107814: MariaDB privilege escalation via dot-files in home directory

CVE-2026-107814 · Severity: high · CVSS 8.4 · Published 2026-10-09

MariaDB is a popular open-source relational database server. In affected RPM packages, the database service account had its home directory set to the data directory, allowing any database user with FILE privilege to write shell startup scripts that would execute with administrative privileges when an administrator logged into the service account. This enables privilege escalation from a database user to system-level access.

Technologies: Mariadb, MariaDB Server. Vendors: Mariadb.

Quick answers

Is CVE-2026-107814 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107814 being exploited in the wild.
How severe is CVE-2026-107814?: High severity, with a CVSS score of 8.4, published 9 October 2026.
Which products and versions are affected?: MariaDB Server 10.6.1 to 10.6.28, 10.11.1 to 10.11.19, 11.4.0 to 11.4.13, 11.8.0 to 11.8.9, 12.3.0 to 12.3.3, 13.0.0 to 13.0.2 (RPM packages only).
Is there a fix for CVE-2026-107814?: Yes: fixed in MariaDB Server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. Until then: Debian packages are not affected and do not require remediation. For RPM-based systems, ensure the mysql service account home directory is set to /nonexistent rather than the data directory. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107814 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-107814?: Check whether you run Mariadb or MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MariaDB Server 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2

Debian packages are not affected and do not require remediation. For RPM-based systems, ensure the mysql service account home directory is set to /nonexistent rather than the data directory.

Technical details

The vulnerability exists because RPM packages configured the mysql service account's $HOME to the data directory, while Debian packages correctly used /nonexistent. A database user holding the FILE privilege could write dot-files like .bash_profile into $HOME, and these would be executed when an administrator opened a login shell for the mysql account, leading to privilege escalation. The fix changes the service account home directory to /nonexistent in RPM packages to match the secure Debian configuration.

Affected products

MariaDB MariaDB Server 10.6.1 to 10.6.28, 10.11.1 to 10.11.19, 11.4.0 to 11.4.13, 11.8.0 to 11.8.9, 12.3.0 to 12.3.3, 13.0.0 to 13.0.2 (RPM packages only)

Timeline

2026-10-09: advisory: CVE-2026-107814 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.