CVE-2026-44169 Details
Description
MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
An authorization bypass vulnerability has been identified in MariaDB Server, specifically in versions 11.4.1 prior to 11.4.11, 11.8.1 prior to 11.8.7, and 12.3.1. The issue allows a user with EXECUTE access to a stored routine via a role to view the routine's definition, even without the SHOW CREATE ROUTINE privilege. This vulnerability arises from the way MariaDB handles routine-level privileges for roles, creating an unintended access path to routine definitions.
Users can upgrade to MariaDB versions 11.4.11, 11.8.7, or 12.3.2 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2 | [email protected] | Vendor Advisory |
| https://jira.mariadb.org/browse/MDEV-39288 | [email protected] | Issue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mariadb mariadb | >= 11.4.1, < 11.4.11 >= 11.8.1, < 11.8.7 12.3.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |