What happened
In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
Affected versions
MariaDB Server: before 10.6.25 (custom); before 10.11.16 (custom); before 11.4.10 (custom); before 11.8.6 (custom); before 2.12.6 (custom); before 3.04.6 (custom); before 3.10.3 (custom); before 3.11.1 (custom); before 5.7.44-RDS.20260212 (custom); before 8.0.45 (custom); before 8.4.8 (custom) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.