MariaDB Windows CONNECT Engine REST Command Injection

Mitigation Strategies

The primary mitigation step is to upgrade MariaDB to a patched version where this vulnerability is fixed.

• Upgrade to MariaDB versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, or 12.3.2 or later.

If immediate upgrade is not possible, consider disabling the CONNECT engine or REST support on Windows to prevent exploitation.

• Disable REST support or the CONNECT engine in your MariaDB configuration.

Also, restrict access to the MariaDB server to trusted users and networks to reduce the risk of exploitation.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-44170 is a vulnerability in MariaDB server on Windows when the CONNECT engine and REST support are enabled. The issue occurs because the HTTP attribute in interpolated tables is passed to the curl command line without proper sanitization or escaping. This improper handling allows an attacker to inject and execute arbitrary shell commands on the server.

This vulnerability is classified as an OS Command Injection (CWE-78), where externally influenced input is used to construct an operating system command without neutralizing special characters, leading to potential command execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary shell commands on the affected MariaDB server. Such command execution can lead to unauthorized access, data compromise, server control, or disruption of services.

Because the attacker can run commands on the server, it may result in data theft, data loss, or further exploitation of the server environment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the CONNECT engine with REST support enabled on MariaDB running on Windows, where the HTTP attribute is passed unsanitized to the curl command line, allowing shell command execution.

To detect if your system is vulnerable, first verify if your MariaDB version is within the affected ranges: 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, or 12.3.1.

Check if the CONNECT engine and REST support are enabled on your MariaDB server.

You can run SQL queries to check for the CONNECT engine and REST support, for example:

• SHOW ENGINES;
• SHOW VARIABLES LIKE 'connect%';

Additionally, monitor logs or network traffic for suspicious curl command executions or unusual shell command activity originating from MariaDB processes.

Useful 0 Not Useful 0