Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

MariaDB Foundation bug bounty programs

mariadb.org Updated

MariaDB Foundation runs three public programs: a Sorona bug bounty paying up to $1,500, a self-hosted disclosure program with no cash rewards and a HackerOne disclosure program with no cash rewards.

Top reward
$1,500
Sorona
Programs
3
1 pays cash
Targets in scope
19
3 types, deduplicated
Last change
6 Nov 2026
6 days ago

Where to report

3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

MariaDB

Sorona · Pays the most of the 3 programs: up to $1,500.
  • MariaDB

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100 (highest)
    Safe harbor
    Partial
  • MariaDB

    Self-hosted · Disclosure only

    Open

    Top reward

    No cash
  • MariaDB

    HackerOne · Disclosure only

    Open

    Top reward

    No cash
    Safe harbor
    Partial
    First response
    5 days average

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

19 targets across all 3 programs, each listed once with the programs that cover it. 6 excluded.

  • mariadb.org

    Web Medium

    Covered by Sorona, Self-hosted, HackerOne

  • MariaDB Server & Connectors - Access control bypass

    Source code Critical No bounty

    Covered by HackerOne

  • MariaDB Server & Connectors - Data corruption, exfiltration, disclosure

    Source code Medium No bounty

    Covered by HackerOne

  • MariaDB Server & Connectors - Denial of Service

    Source code Medium No bounty

    Covered by HackerOne

  • MariaDB Server & Connectors - Remote Code Execution

    Source code Critical No bounty

    Covered by HackerOne

  • Every storage engine shipped in the tree, including InnoDB, Aria, MyISAM, MyRocks, ColumnStore, Spider, CONNECT and FederatedX

    Products and areas

    Covered by Sorona

  • information_schema, performance_schema and the system tables, and what a low-privileged account can read from them

    Products and areas

    Covered by Sorona

  • LOAD DATA LOCAL INFILE and the client-side file handling a server can request through it

    Products and areas

    Covered by Sorona

  • Replication end to end: the binary log formats, GTID handling, semi-synchronous replication and the Galera integration

    Products and areas

    Covered by Sorona

  • The authentication plugins the tree ships, covering mysql_native_password, ed25519, unix_socket, PAM, GSSAPI and the pluggable authentication interface itself

    Products and areas

    Covered by Sorona

  • The client and server wire protocol, the handshake in front of it and the capability negotiation a client can drive

    Products and areas

    Covered by Sorona

  • The client tools the project ships, including mysqldump, mariabackup and the command line client

    Products and areas

    Covered by Sorona

  • The engines and functions that make outbound connections or read the filesystem, in particular CONNECT, FederatedX, Spider and LOAD DATA

    Products and areas

    Covered by Sorona

  • The Foundation accepts reports through its HackerOne disclosure programme or at [email protected], and states it runs no bug bounty and pays nothing. The declared surface is the server the project releases, with nothing narrower carved out

    Products and areas

    Covered by Sorona

  • The JSON functions, dynamic columns, and the character set and collation conversion paths

    Products and areas

    Covered by Sorona

  • The privilege system in full: GRANT evaluation, roles, column and table level privileges, and the definer semantics on views, stored routines, triggers and events

    Products and areas

    Covered by Sorona

  • The SQL parser and the optimiser, including every rewrite the optimiser performs on a query before it runs

    Products and areas

    Covered by Sorona

  • TLS configuration, certificate verification and the encryption of both client connections and replication links

    Products and areas

    Covered by Sorona

  • User-defined functions, the plugin loading path and anything that loads a shared object into the server process

    Products and areas

    Covered by Sorona

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A privilege an administrator deliberately granted, such as FILE or SUPER to an account that should not have had it

    Sorona

  • Connectors and client libraries maintained outside the server repository

    Sorona

  • Distribution packaging, init scripts and distro-specific patches rather than upstream MariaDB

    Sorona

  • MariaDB plc's enterprise builds and SkySQL, which are the commercial company's products with their own reporting path

    Sorona

  • MySQL, Percona Server and other forks, each with its own vendor and process

    Sorona

  • Upstream libraries the server links, unless MariaDB's own use of them is what makes the defect reachable

    Sorona

Recent changes

Reward and scope changes across every MariaDB Foundation program, newest first.

  • MariaDB

    Back HackerOne

    Open for reports again.

  • MariaDB

    Paused HackerOne

    Paused. Not accepting reports right now.

  • MariaDB

    Back HackerOne

    Open for reports again.

  • MariaDB

    Paused HackerOne

    Paused. Not accepting reports right now.

All changes · RSS feed

Recent CVEs

Published vulnerabilities in MariaDB Foundation products, from the NVD.

Search NVD
  • CVE-2026-97380 High

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error

  • CVE-2026-97380 High

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error

  • CVE-2026-97380 High

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error

  • CVE-2026-92262 Critical

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under th

  • CVE-2026-92262 Critical

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under th

  • CVE-2026-92262 Critical

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under th

  • CVE-2026-85985 Medium

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a

  • CVE-2026-86047 High

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or va

About this page

This page gathers every public program listed under mariadb.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.