CVE-2026-85985

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85985", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-04T19:17:36.245Z", "datePublished": "2026-10-16T16:21:14.677Z", "dateUpdated": "2026-10-16T17:05:42.975Z"}, "containers": {"cna": {"title": "MariaDB: Unauthorized file access via CONNECT engine UDFs", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6"}, {"name": "https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"}, {"name": "https://jira.mariadb.org/browse/MDEV-40323", "tags": ["x_refsource_MISC"], "url": "https://jira.mariadb.org/browse/MDEV-40323"}], "affected": [{"vendor": "MariaDB", "product": "server", "versions": [{"version": ">= 10.6.1, < 10.6.28", "status": "affected"}, {"version": ">= 10.11.1, < 10.11.19", "status": "affected"}, {"version": ">= 11.4.1, < 11.4.13", "status": "affected"}, {"version": ">= 11.8.1, < 11.8.9", "status": "affected"}, {"version": ">= 12.3.1, < 12.3.3", "status": "affected"}, {"version": ">= 13.0.1, < 13.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-16T16:21:14.677Z"}, "descriptions": [{"lang": "en", "value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}], "source": {"advisory": "GHSA-2245-9hm3-wxf6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-16T16:49:34.979927Z", "id": "CVE-2026-85985", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T17:05:42.975Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85985", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-04T19:17:36.245Z", "datePublished": "2026-10-16T16:21:14.677Z", "dateUpdated": "2026-10-16T17:05:42.975Z"}, "containers": {"cna": {"title": "MariaDB: Unauthorized file access via CONNECT engine UDFs", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6"}, {"name": "https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"}, {"name": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"}, {"name": "https://jira.mariadb.org/browse/MDEV-40323", "tags": ["x_refsource_MISC"], "url": "https://jira.mariadb.org/browse/MDEV-40323"}], "affected": [{"vendor": "MariaDB", "product": "server", "versions": [{"version": ">= 10.6.1, < 10.6.28", "status": "affected"}, {"version": ">= 10.11.1, < 10.11.19", "status": "affected"}, {"version": ">= 11.4.1, < 11.4.13", "status": "affected"}, {"version": ">= 11.8.1, < 11.8.9", "status": "affected"}, {"version": ">= 12.3.1, < 12.3.3", "status": "affected"}, {"version": ">= 13.0.1, < 13.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-16T16:21:14.677Z"}, "descriptions": [{"lang": "en", "value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}], "source": {"advisory": "GHSA-2245-9hm3-wxf6", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85985", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T16:49:34.979927Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T16:49:40.065Z"}}]}}

{"affected": [{"affectedData": [{"product": "server", "vendor": "MariaDB", "versions": [{"status": "affected", "version": ">= 10.6.1, < 10.6.28"}, {"status": "affected", "version": ">= 10.11.1, < 10.11.19"}, {"status": "affected", "version": ">= 11.4.1, < 11.4.13"}, {"status": "affected", "version": ">= 11.8.1, < 11.8.9"}, {"status": "affected", "version": ">= 12.3.1, < 12.3.3"}, {"status": "affected", "version": ">= 13.0.1, < 13.0.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A6667AA-6A82-49E2-894B-318569872468", "versionEndExcluding": "10.6.28", "versionStartIncluding": "10.6.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "C18A44B6-CEEF-47D7-9D60-04E6EBAFC785", "versionEndExcluding": "10.11.19", "versionStartIncluding": "10.11.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "47070DA5-F754-4FE1-957A-375C39D9029E", "versionEndExcluding": "11.4.13", "versionStartIncluding": "11.4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "39AD11EC-57BE-4D2B-9A7C-E667E23A6940", "versionEndExcluding": "11.8.9", "versionStartIncluding": "11.8.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6988F1C-2D11-431B-BBE4-3AA8483627C8", "versionEndExcluding": "12.3.3", "versionStartIncluding": "12.3.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mariadb:mariadb:13.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "E46FBE57-06D5-489E-9ECE-333F5F9AFD06", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}], "id": "CVE-2026-85985", "lastModified": "2026-10-20T15:32:46.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85985", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T16:49:34.979927Z", "version": "2.0.3"}}]}, "published": "2026-10-16T17:17:51.620", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://jira.mariadb.org/browse/MDEV-40323"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mariadb: MariaDB: Unauthorized file access via CONNECT engine functions", "id": "2554196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554196"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-552", "details": ["A flaw was found in MariaDB. Certain file-access User-Defined Functions (UDFs) within the CONNECT storage engine do not properly enforce user privileges or directory restrictions when handling file system paths. An authenticated, low-privileged database user can exploit this vulnerability to read from or write to unauthorized files on the underlying server, subject to the database process's operating system permissions."], "name": "CVE-2026-85985", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "mariadb10.11", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "mariadb11.8", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "mariadb", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb:10.11/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mariadb-devel:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb:10.11/mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "mariadb:11.8/mariadb", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "mariadb10.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "mariadb11.8", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "mariadb", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}], "public_date": "2026-10-16T16:21:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-85985\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85985\nhttps://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe\nhttps://github.com/MariaDB/server/releases/tag/mariadb-10.11.19\nhttps://github.com/MariaDB/server/releases/tag/mariadb-10.6.28\nhttps://github.com/MariaDB/server/releases/tag/mariadb-11.4.13\nhttps://github.com/MariaDB/server/releases/tag/mariadb-11.8.9\nhttps://github.com/MariaDB/server/releases/tag/mariadb-12.3.3\nhttps://github.com/MariaDB/server/releases/tag/mariadb-13.0.2\nhttps://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6\nhttps://jira.mariadb.org/browse/MDEV-40323"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.6.1,10.6.28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.11.1,10.11.19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.4.1,11.4.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.8.1,11.8.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.3.1,12.3.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.1,13.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "server", "source": "cna", "vendor": "MariaDB"}, "product": "server", "vendor": "mariadb"}], "created": "2026-10-16T19:45:14.247235+00:00", "updated": "2026-10-18T14:30:13.671231+00:00", "vendors": ["mariadb", "mariadb$PRODUCT$server"]}