Is CVE-2026-44170 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44170 being exploited in the wild.

How severe is CVE-2026-44170?

Informational severity, with a CVSS score of 6.3, published 12 June 2026.

Which products and versions are affected?

MariaDB Foundation MariaDB Server 10.6.1 to 10.6.25, 10.11.1 to 10.11.16, 11.4.1 to 11.4.10, 11.8.1 to 11.8.6, 12.3.1.

Is there a fix for CVE-2026-44170?

A patch was published on 2026-04-12: Issue resolved in source code Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44170 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-44170?

Check whether you run MariaDB Foundation MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44170: MariaDB OS command injection in CONNECT engine on Windows

CVE-2026-44170 · Severity: info · CVSS 6.3 · Published 2026-06-12

MariaDB is a widely used database system for storing and managing business data. A security flaw in the Windows version of the software allows an attacker to execute unauthorized commands on the server hosting the database. This could lead to a full system compromise, data theft, or disruption of database services.

Technologies: MariaDB Foundation MariaDB Server. Vendors: MariaDB Foundation.

Quick answers

Is CVE-2026-44170 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44170 being exploited in the wild.
How severe is CVE-2026-44170?: Informational severity, with a CVSS score of 6.3, published 12 June 2026.
Which products and versions are affected?: MariaDB Foundation MariaDB Server 10.6.1 to 10.6.25, 10.11.1 to 10.11.16, 11.4.1 to 11.4.10, 11.8.1 to 11.8.6, 12.3.1.
Is there a fix for CVE-2026-44170?: A patch was published on 2026-04-12: Issue resolved in source code Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44170 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-44170?: Check whether you run MariaDB Foundation MariaDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in MariaDB for Windows when using the CONNECT storage engine with REST support enabled. The vulnerability stems from the improper sanitization of the table HTTP attribute before it is interpolated into a 'curl' command line string. Specifically, the software uses sprintf to construct a command for CreateProcess without escaping the URL input. An attacker can exploit this to inject additional shell commands that will be executed with the privileges of the MariaDB service. The issue is fixed in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Affected products

MariaDB MariaDB Server 10.6.1 to 10.6.25, 10.11.1 to 10.11.16, 11.4.1 to 11.4.10, 11.8.1 to 11.8.6, 12.3.1

Timeline

2026-04-08: other: Issue reported to MariaDB Jira
2026-04-12: patched: Issue resolved in source code
2026-05-18: advisory: GitHub security advisory published
2026-06-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.