CVE-2026-3494: MariaDB and Amazon RDS audit log bypass via SQL comment prefixing

CVE-2026-3494 · Severity: high · CVSS 4.3 · Published 2026-03-03

A vulnerability in the MariaDB and Amazon RDS/Aurora audit logging system allows authenticated users to bypass activity monitoring. By adding specific comment characters to the beginning of a database command, a user can execute actions that are not recorded in the security logs. This could allow malicious activity to go undetected by security teams relying on these logs for compliance or incident response.

Technologies: Amazon AWS, MariaDB Foundation MariaDB Server. Vendors: Amazon, Amazon Web Services, MariaDB Foundation.

Quick answers

Is CVE-2026-3494 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3494 being exploited in the wild.
How severe is CVE-2026-3494?
High severity, with a CVSS score of 4.3, published 3 March 2026.
Which products and versions are affected?
Amazon Web Services Aurora MySQL 2.12.5 and prior, 3.01.0 to 3.04.5, 3.05.1 to 3.10.2, 3.11.0; Amazon Web Services RDS for MariaDB 10.6.24 and prior, 10.11.4 to 10.11.15, 11.4.3 to 11.4.9, 11.8.3 to 11.8.5; Amazon Web Services RDS for MySQL 5.7.44-RDS.20251212 and prior, 8.0.11 to 8.0.44, 8.4.3 to 8.4.7; MariaDB Foundation MariaDB Server <= 10.6.24, 10.11.15, 11.4.9, 11.8.5, 10.6.24 and prior, 10.11.15 and prior, 11.4.9 and prior, 11.8.5 and prior.
Is there a fix for CVE-2026-3494?
A patch was published on 2026-03-03. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3494 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-3494?
Check whether you run Amazon AWS, Amazon Web Services Aurora MySQL, Amazon Web Services RDS for MariaDB or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An insufficient logging vulnerability (CWE-778) exists in the MariaDB Server Audit Plugin and its derivatives used in Amazon RDS and Aurora. The issue stems from the audit plugin's internal SQL parser failing to correctly handle statements prefixed with double-hyphen (--) or hash (#) style comments when specific event filtering (QUERY_DCL, QUERY_DDL, or QUERY_DML) is enabled. An authenticated attacker can exploit this by prefixing their SQL commands with these comment strings, causing the server to execute the command without recording it in the audit log. This bypasses security auditing and compliance monitoring. The fix involves removing the plugin's custom parser in favor of the core server's SQL command handling.

Affected products

  • MariaDB Foundation MariaDB Server <= 10.6.24, 10.11.15, 11.4.9, 11.8.5
  • Amazon Aurora MySQL <= 2.12.5, 3.01.0 to 3.04.5, 3.05.1 to 3.10.2, 3.11.0
  • Amazon RDS for MySQL <= 5.7.44-RDS.20251212, 8.0.11 to 8.0.44, 8.4.3 to 8.4.7
  • Amazon RDS for MariaDB <= 10.6.24, 10.11.4 to 10.11.15, 11.4.3 to 11.4.9, 11.8.3 to 11.8.5

Timeline

  • 2026-03-03: disclosed
  • 2026-03-03: advisory: AWS Security Bulletin 2026-006-AWS published
  • 2026-03-03: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.