CVE-2026-44170

What it actually does

On Windows MariaDB servers with the CONNECT storage engine installed and REST support enabled, affected versions pass the CONNECT table HTTP attribute into a curl command line without sufficient sanitization. A user able to create or modify a relevant CONNECT REST table can inject shell metacharacters or additional commands, causing arbitrary command execution on the database server in the security context of the MariaDB service account. The issue affects MariaDB 10.6.1 through 10.6.25, 10.11.1 through 10.11.16, 11.4.1 through 11.4.10, 11.8.1 through 11.8.6, and 12.3.1 on Windows under the vulnerable feature configuration.

Why it matters to the business

Successful exploitation can turn database access into operating-system command execution, enabling data theft, service disruption, malware deployment, or further compromise of Windows infrastructure. The risk is highest where MariaDB is reachable by untrusted users or applications allow attackers to influence SQL statements. Although it is not currently listed in CISA KEV, has no known exploit maturity in the provided data, and has a relatively low EPSS score of 0.01334, the CVSS 9.8 severity means exposed Windows deployments using CONNECT REST should be prioritized for upgrade or mitigation.

How an attack unfolds

An attacker first obtains a way to submit SQL to a vulnerable MariaDB Windows server, either through direct database access, stolen credentials, overly permissive application database accounts, or an SQL injection path in an application. They verify or assume that the CONNECT engine is installed and REST support is enabled. The attacker then creates or alters a CONNECT REST table and places command-injection syntax in the HTTP attribute that is later interpolated into the curl command line. When MariaDB processes the table’s REST access, it invokes curl with the attacker-controlled value, and the Windows command interpreter executes the injected command. The resulting commands run as the MariaDB service account and may be used to run reconnaissance, write files, download tooling, create persistence, access database files, or pivot to other systems.

How to fix it

Upgrade affected MariaDB Windows deployments to a fixed release: 10.6.26 or later, 10.11.17 or later, 11.4.11 or later, 11.8.7 or later, or 12.3.2 or later. If immediate upgrade is not possible, disable or uninstall the CONNECT storage engine where it is not required, disable CONNECT REST support, and restrict privileges that allow users or applications to create, alter, or access CONNECT REST tables. Limit database network exposure to trusted hosts, rotate credentials for accounts with DDL privileges, and run the MariaDB service under a least-privileged Windows account rather than an administrative account.

How to confirm the fix worked

Confirm the server is not running an affected Windows version by checking the MariaDB version and patch level with SELECT VERSION(); or the MariaDB service/package metadata. Verify whether the CONNECT engine is present and active using SHOW ENGINES; or SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME LIKE '%CONNECT%';. Review whether CONNECT REST tables exist by inspecting schema definitions for ENGINE=CONNECT, TABLE_TYPE=REST, and HTTP attributes. Confirm compensating controls by validating that untrusted users cannot create or alter CONNECT tables and that MariaDB is not exposed to unnecessary networks. After patching, restart the service if required and re-check that the running version is one of the fixed releases or later.

Typical attack path

1. Identify a Windows MariaDB server running an affected version with the CONNECT engine installed and REST support enabled.
2. Gain the ability to execute SQL against the server, directly or indirectly through an application flaw or compromised database credentials.
3. Create or modify a CONNECT REST table with a malicious HTTP attribute containing shell command-injection characters or payloads.
4. Trigger access to the CONNECT REST table so MariaDB builds and executes the vulnerable curl command line.
5. Execute operating-system commands under the MariaDB service account, such as launching cmd.exe or powershell.exe, writing files, or downloading additional payloads.
6. Use the foothold to collect data, escalate privileges if possible, establish persistence, disrupt services, or move laterally.

How to detect it

Review MariaDB general query logs, audit plugin logs, binary logs if DDL is captured, application SQL logs, and schema definitions for CREATE TABLE or ALTER TABLE statements using ENGINE=CONNECT with REST table options and attacker-controlled HTTP attributes. On Windows, examine Security Event ID 4688, Sysmon Event ID 1, PowerShell logs, EDR process trees, and service logs for mysqld.exe spawning curl.exe, cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, rundll32.exe, or mshta.exe. Investigate any command shells or script interpreters whose parent process is mysqld.exe, especially around the time CONNECT REST tables were created or queried. Check for newly created files in MariaDB directories, temporary directories, web-accessible directories, scheduled tasks, new services, or unusual outbound HTTP/S connections from the database server. Because exploitation payloads are user-controlled, prioritize behavioral evidence rather than relying only on fixed strings.

• ENGINE=CONNECT
• TABLE_TYPE=REST
• TABLE_TYPE='REST'
• TABLE_TYPE="REST"
• HTTP=
• CREATE TABLE%ENGINE=CONNECT%HTTP=
• ALTER TABLE%ENGINE=CONNECT%HTTP=
• mysqld.exe -> cmd.exe
• mysqld.exe -> powershell.exe
• mysqld.exe -> curl.exe
• mysqld.exe -> certutil.exe
• mysqld.exe -> bitsadmin.exe
• mysqld.exe -> mshta.exe
• mysqld.exe -> wscript.exe
• mysqld.exe -> cscript.exe
• ParentImage=*\\mysqld.exe Image=*\\cmd.exe
• ParentImage=*\\mysqld.exe Image=*\\powershell.exe
• ParentImage=*\\mysqld.exe Image=*\\curl.exe
• ParentImage=*\\mysqld.exe Image=*\\certutil.exe
• ParentImage=*\\mysqld.exe Image=*\\bitsadmin.exe
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• curl.exe http
• curl.exe https

What your security team should do

• Prioritize inventory of Windows MariaDB servers and identify those running affected versions with CONNECT installed and REST support enabled.
• Upgrade vulnerable systems to MariaDB 10.6.26, 10.11.17, 11.4.11, 11.8.7, 12.3.2, or later according to the deployed branch.
• Temporarily disable or remove the CONNECT engine and REST capability where they are not business-critical.
• Audit database accounts and applications for CREATE, ALTER, FILE, SUPER, or other elevated privileges that could enable malicious CONNECT table creation or modification.
• Search database audit logs, general query logs, Windows process creation telemetry, and EDR data for suspicious CONNECT REST table definitions and child processes spawned by mysqld.exe.
• Restrict inbound MariaDB access to approved application hosts and administrative networks only.
• Rotate credentials and investigate further if suspicious CONNECT table DDL, curl execution, cmd.exe, or powershell.exe activity is observed from the MariaDB service process.