CVE-2026-44169: MariaDB Information Disclosure Flaw

CVE-2026-44169 Overview

CVE-2026-44169 is an authorization flaw in MariaDB server, a community-developed fork of MySQL. The vulnerability allows a database user who obtains EXECUTE access to a stored routine through a role to view the routine definition without holding the SHOW CREATE ROUTINE privilege. This results in unauthorized disclosure of routine source code, which may contain sensitive business logic, embedded credentials, or schema details. The issue affects MariaDB versions 11.4.1 through 11.4.10, 11.8.1 through 11.8.6, and 12.3.1. MariaDB has patched the flaw in versions 11.4.11, 11.8.7, and 12.3.2. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated database users with role-granted EXECUTE privileges can read stored routine definitions, potentially exposing proprietary logic, credentials hardcoded in routines, or schema details useful for further attacks.

Affected Products

MariaDB server versions 11.4.1 through 11.4.10
MariaDB server versions 11.8.1 through 11.8.6
MariaDB server version 12.3.1

Discovery Timeline

2026-06-12 - CVE-2026-44169 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-44169

Vulnerability Analysis

The vulnerability resides in MariaDB's privilege enforcement logic for stored routines. In MariaDB, accessing the textual definition of a stored procedure or function requires the SHOW CREATE ROUTINE privilege. The privilege check fails to correctly evaluate the access path when EXECUTE permission on a routine is granted indirectly through a role rather than directly to a user. As a result, a user who has activated such a role can retrieve the full routine source, bypassing the intended privilege separation between execution and definition access.

Stored routine bodies frequently contain SQL queries that reveal table structures, column names, join logic, and conditional flows. Some organizations also embed credentials, API tokens, or hardcoded business rules inside routines. Disclosure of this content provides attackers with reconnaissance value and may directly expose secrets.

Root Cause

The root cause is incorrect authorization handling [CWE-863] in the routine metadata lookup path. The privilege resolution routine treats role-inherited EXECUTE rights as sufficient justification to expose routine definitions, conflating execute-time access with definition-time access. The check does not enforce that SHOW CREATE ROUTINE must be held independently before returning routine bodies through information schema queries or SHOW CREATE statements.

Attack Vector

Exploitation requires an authenticated database session with low privileges. The attacker must hold a role that grants EXECUTE on the target routine. After activating the role with SET ROLE, the attacker can query the routine definition through standard SQL interfaces such as SHOW CREATE PROCEDURE, SHOW CREATE FUNCTION, or queries against information_schema.ROUTINES. No user interaction beyond the attacker's own session is required, and the attack is reachable over the network on any MariaDB instance exposing the SQL port to the attacker.

No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the MariaDB GitHub Security Advisory GHSA-22xq-vq3f-87x2 and MariaDB Jira issue MDEV-39288 for vendor technical details.

Detection Methods for CVE-2026-44169

Indicators of Compromise

Audit log entries showing SHOW CREATE PROCEDURE or SHOW CREATE FUNCTION statements issued by accounts that lack the SHOW CREATE ROUTINE privilege.
Queries against information_schema.ROUTINES selecting the ROUTINE_DEFINITION column from users whose direct grants do not include routine metadata access.
Unusual SET ROLE activations immediately followed by routine definition lookups.

Detection Strategies

Enable the MariaDB audit plugin (server_audit) and capture QUERY events to record statements that read routine definitions.
Correlate role activation events with subsequent metadata queries to identify users leveraging role-inherited privileges for reconnaissance.
Compare the privilege grants in mysql.user, mysql.roles_mapping, and mysql.procs_priv against accounts observed reading routine source.

Monitoring Recommendations

Forward MariaDB audit logs to a centralized logging or SIEM platform and alert on access to information_schema.ROUTINES.ROUTINE_DEFINITION by non-administrative accounts.
Track the MariaDB server version across the estate and flag any instance still running an affected build.
Review stored routine inventories for hardcoded secrets that would constitute material loss if disclosed under this flaw.

How to Mitigate CVE-2026-44169

Immediate Actions Required

Upgrade MariaDB to a fixed release: 11.4.11, 11.8.7, or 12.3.2 as appropriate for the deployed branch.
Inventory all stored routines and remove embedded credentials, API keys, or other secrets that could be exposed through definition disclosure.
Audit role assignments and revoke EXECUTE grants on sensitive routines from roles that are broadly assigned to non-administrative users.

Patch Information

MariaDB has released patched versions 11.4.11, 11.8.7, and 12.3.2 that correct the authorization check. The fix is tracked in MariaDB Jira MDEV-39288 and documented in the MariaDB GitHub Security Advisory GHSA-22xq-vq3f-87x2. Apply the upgrade through the standard package manager or by replacing the server binary, then restart the mariadbd service.

Workarounds

Grant EXECUTE on sensitive routines directly to user accounts rather than through roles until the patch is applied.
Restrict network access to the MariaDB port so that only trusted application accounts can authenticate, reducing the population of users able to invoke the issue.
Rotate any credentials or tokens previously hardcoded inside stored routines that may have been read by users with role-based EXECUTE access.

bash

# Configuration example: verify patched version and review role grants
mariadb -u root -p -e "SELECT VERSION();"
mariadb -u root -p -e "SELECT * FROM mysql.roles_mapping;"
mariadb -u root -p -e "SELECT User, Db, Routine_name, Proc_priv FROM mysql.procs_priv;"