DEV Community

andreagomez
andreagomez

Posted on

CVE-2026-107815: The CONNECT Storage Engine as a Write Primitive

CVE-2026-107815: The CONNECT Storage Engine as a Write Primitive

Vulnerability overview

Among the five MariaDB Server flaws in CSA Singapore alert AL-2026-144, CVE-2026-107815 carries the highest score at 8.5 under CVSS v3.1. The advisory's description is short: an authenticated user can use the CONNECT engine to cause a crash and potentially execute arbitrary code. That sentence contains two very different outcomes, and defenders need to plan for the second.

Mechanism and exploitation conditions

CONNECT is a storage engine designed to reach outside the server, reading files and talking to other data sources on behalf of the database. That design is what makes it useful and what makes this flaw consequential. An authenticated user with access to the engine gives crafted input to a component whose normal job is parsing foreign formats.

The advisory stops at the level of crash and potential code execution. It does not name the input field, the vulnerable handler, or a public proof of concept. Any write-up that fills that gap with invented offsets or structures is fabricating detail. What a defender can work with is the precondition: an authenticated session that can invoke CONNECT.

That precondition is less rare than it sounds. CONNECT ships with many builds, and shared database services sometimes leave engine privileges at defaults because turning features off requires a deliberate decision. A single low-privilege account on such an instance is enough to reach the vulnerable surface.

Impact

A crash alone is a denial-of-service problem on a stateful service, and database restarts cost more than the downtime itself: crash recovery, replica lag, and application retry storms all follow. The more serious reading is memory corruption that the advisory classifies as potentially leading to arbitrary code execution.

Code execution in the mysqld process is effectively full database compromise. The attacker inherits the service account's filesystem visibility, can read every schema, and can move against backup directories and configuration files. If the instance holds credentials for downstream systems, those leave with the attacker.

Affected products and scope

The affected ranges are 10.6.1 to 10.6.27, 10.11.1 to 10.11.18, 11.4.1 to 11.4.12, 11.8.1 to 11.8.8, 12.3.1 to 12.3.2 and 13.0.1. Whether CONNECT must be installed and enabled for exploitation is not specified in the advisory, so treat every build inside those ranges as exposed until you have evidence otherwise.

Exposure context

A ZoomEye fingerprint query for app="MariaDB" returns 5111720 matching assets. That number measures how much MariaDB is on the public internet, which is why an engine-level flaw matters beyond a single estate. It does not indicate which assets are running an affected build, which have CONNECT available, or which grant untrusted users a session.

ZoomEye search: https://www.zoomeye.ai/searchResult?q=YXBwPSJNYXJpYURCIg%3D%3D

Remediation and mitigations

Apply the fixed build for your branch. After upgrading, verify the server build string rather than trusting that a package refresh succeeded.

If CONNECT is not part of your application design, disable the engine. Removing an unused feature removes the attack surface entirely, and this is the cheapest durable control available. Where the engine is genuinely required, restrict who can create tables using it, and separate those accounts from ordinary application identities.

Assume compromise if you find evidence of an unexplained restart combined with suspicious CONNECT table definitions. Preserve logs before restarting the service again, and rotate database credentials held in configuration.

References

Top comments (0)