CVE-2026-107818

A flaw was found in MariaDB. An authenticated database user with file write permissions can create an unauthorized configuration file in the service runtime directory. During a subsequent service restart, the service unit loads this file and injects attacker-controlled environment variables into the process. This flaw allows an attacker to escalate privileges and potentially achieve arbitrary code execution on the underlying host system.

Red Hat rates this vulnerability as Important because an authenticated database user can escape database-level isolation to inject arbitrary environment variables into the host service manager context, leading to host privilege escalation. Exploitation requires the attacker to possess elevated database rights, specifically the FILE privilege, alongside a configuration that allows writing to the daemon runtime directory, followed by a service restart. Typical Red Hat Enterprise Linux configurations constrain file write locations by default, limiting the potential attack surface unless permissive file export settings or non-standard privileges have been granted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to the fixed version of MariaDB Server