CVE-2026-44173: MariaDB SQL Injection Vulnerability

CVE-2026-44173 Overview

CVE-2026-44173 is an authorization bypass vulnerability in MariaDB server, the community-developed fork of MySQL. The flaw allows authenticated users to execute SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE statements without holding the required FILE privilege when the FROM clause contains only subqueries. This breaks the privilege check intended to restrict server-side file writes to trusted accounts. The issue maps to [CWE-863] Incorrect Authorization and affects MariaDB versions 10.6.1 through 12.3.1, with fixes in 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Critical Impact
Authenticated database users without the FILE privilege can write query results to arbitrary paths on the database server filesystem, enabling unauthorized data export and potential overwrite of server-readable files.

Affected Products

MariaDB server versions 10.6.1 to before 10.6.26
MariaDB server versions 10.11.1 to before 10.11.17, and 11.4.1 to before 11.4.11
MariaDB server versions 11.8.1 to before 11.8.7, and 12.3.1

Discovery Timeline

2026-06-12 - CVE-2026-44173 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-44173

Vulnerability Analysis

MariaDB enforces the FILE privilege to control which users can read from or write to the server filesystem through SQL statements. The SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE constructs write query output to a path on the database host. These statements must be gated by a FILE privilege check before execution.

The vulnerability stems from a missing privilege verification path. When the FROM clause references only subqueries rather than base tables, the parser and authorization layer fail to invoke the FILE privilege check. The server proceeds to execute the file write as if the user were authorized.

An authenticated attacker with any standard database account can leverage this gap to export data or write attacker-controlled content to disk. The impact is scoped to integrity of files writable by the MariaDB process account. Confidentiality and availability of the database service are not directly affected, which aligns with the integrity-only impact rating. The flaw is tracked publicly as MDEV-39493.

Root Cause

The privilege evaluation logic in the query preparation phase only triggers FILE privilege checks when a base table appears in the FROM clause. Queries that derive their result set entirely from subqueries bypass this code path, leaving the INTO OUTFILE and INTO DUMPFILE targets unauthorized but accepted.

Attack Vector

An authenticated user issues a SELECT ... INTO OUTFILE '/path/to/target' statement where the FROM clause contains only a derived table or subquery expression. The server skips the FILE privilege check and writes the result set to the specified filesystem path under the privileges of the MariaDB service account. No user interaction or elevated privileges are required beyond standard SQL access.

Verified exploitation code is not published. The vulnerability mechanism is described in the MariaDB GitHub Security Advisory GHSA-667j-m53j-wpmc.

Detection Methods for CVE-2026-44173

Indicators of Compromise

Unexpected files created in directories writable by the MariaDB service account, particularly under data directories or temporary paths.
General query log or audit log entries showing SELECT ... INTO OUTFILE or SELECT ... INTO DUMPFILE statements issued by accounts that do not hold the FILE privilege.
New or modified files on the database host with ownership matching the mysql or mariadb process user and timestamps correlating to user query activity.

Detection Strategies

Enable the MariaDB audit plugin and alert on any statement containing INTO OUTFILE or INTO DUMPFILE keywords.
Cross-reference users issuing file-write SQL against the mysql.global_priv table to flag accounts without FILE privilege using these constructs.
Monitor filesystem changes in MariaDB-writable directories using host-based file integrity monitoring.

Monitoring Recommendations

Forward MariaDB audit logs to a centralized SIEM and build correlation rules for INTO OUTFILE and INTO DUMPFILE activity tied to non-privileged users.
Track the running MariaDB server version across the fleet to identify unpatched instances in the 10.6.x, 10.11.x, 11.4.x, 11.8.x, and 12.3.x branches.
Baseline normal FILE privilege usage and alert on deviations from expected service accounts.

How to Mitigate CVE-2026-44173

Immediate Actions Required

Upgrade MariaDB to a patched release: 10.6.26, 10.11.17, 11.4.11, 11.8.7, or 12.3.2.
Inventory database accounts and remove unnecessary privileges, applying least privilege to every login.
Review recent audit logs for INTO OUTFILE and INTO DUMPFILE activity executed by accounts lacking FILE privilege.

Patch Information

The MariaDB project addressed the missing authorization check in the fixed releases listed above. Patch details and downstream package guidance are published in the MariaDB Security Advisory GHSA-667j-m53j-wpmc and the upstream issue MDEV-39493. Distribution vendors will ship backported fixes; apply the corresponding distribution security update where available.

Workarounds

Restrict the secure_file_priv server variable to an empty value or a tightly controlled directory to limit where INTO OUTFILE and INTO DUMPFILE can write.
Enforce network-level restrictions so only application service accounts can reach the MariaDB port, reducing the attacker population to authenticated sessions only.
Revoke any unnecessary FILE privilege grants and audit application accounts that do not require file export functionality.

bash

# Configuration example: disable server-side file writes in my.cnf
[mysqld]
secure_file_priv = ""