- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 15
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
15 assets you may test, 6 excluded.
Web 1
- https://mariadb.org
Products and areas 14
- Every storage engine shipped in the tree, including InnoDB, Aria, MyISAM, MyRocks, ColumnStore, Spider, CONNECT and FederatedX
- information_schema, performance_schema and the system tables, and what a low-privileged account can read from them
- LOAD DATA LOCAL INFILE and the client-side file handling a server can request through it
- Replication end to end: the binary log formats, GTID handling, semi-synchronous replication and the Galera integration
- The authentication plugins the tree ships, covering mysql_native_password, ed25519, unix_socket, PAM, GSSAPI and the pluggable authentication interface itself
- The client and server wire protocol, the handshake in front of it and the capability negotiation a client can drive
- The client tools the project ships, including mysqldump, mariabackup and the command line client
- The engines and functions that make outbound connections or read the filesystem, in particular CONNECT, FederatedX, Spider and LOAD DATA
- The Foundation accepts reports through its HackerOne disclosure programme or at [email protected], and states it runs no bug bounty and pays nothing. The declared surface is the server the project releases, with nothing narrower carved out
- The JSON functions, dynamic columns, and the character set and collation conversion paths
- The privilege system in full: GRANT evaluation, roles, column and table level privileges, and the definer semantics on views, stored routines, triggers and events
- The SQL parser and the optimiser, including every rewrite the optimiser performs on a query before it runs
- TLS configuration, certificate verification and the encryption of both client connections and replication links
- User-defined functions, the plugin loading path and anything that loads a shared object into the server process
Out of scope (6)
- A privilege an administrator deliberately granted, such as FILE or SUPER to an account that should not have had it
- Connectors and client libraries maintained outside the server repository
- Distribution packaging, init scripts and distro-specific patches rather than upstream MariaDB
- MariaDB plc's enterprise builds and SkySQL, which are the commercial company's products with their own reporting path
- MySQL, Percona Server and other forks, each with its own vendor and process
- Upstream libraries the server links, unless MariaDB's own use of them is what makes the defect reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report through the MariaDB Foundation vulnerability disclosure programme on HackerOne, or by email to the address on the policy page
-
Give the exact statement, the account's grants and the server version.
-
Name the storage engine and the authentication plugin.
-
State whether the finding needs FILE, SUPER or a similarly powerful privilege.
-
Hold detail until the fixed versions are out.
Not accepted
-
A privilege an administrator deliberately granted, such as FILE or SUPER to an account that should not have had it
-
Distribution packaging, init scripts and distro-specific patches rather than upstream MariaDB
-
Connectors and client libraries maintained outside the server repository
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 23 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-97380 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error | High 8.8 | 16 Oct 2026 |
| CVE-2026-92262 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under th | Critical 9.9 | 16 Oct 2026 |
| CVE-2026-85985 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a | Medium 5.4 | 16 Oct 2026 |
| CVE-2026-86047 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or va | High 7.7 | 16 Oct 2026 |
| CVE-2026-85745 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spa | Medium 4.3 | 16 Oct 2026 |
| CVE-2026-85746 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially cra | Critical 9.9 | 16 Oct 2026 |
| CVE-2026-85748 | MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vuln | Critical 9.9 | 16 Oct 2026 |
| CVE-2026-107821 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or pot | High 8.0 | 9 Oct 2026 |
| CVE-2026-107822 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's da | Medium 6.4 | 9 Oct 2026 |
| CVE-2026-107823 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of | High 7.2 | 9 Oct 2026 |
| CVE-2026-107816 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashin | Medium 6.4 | 9 Oct 2026 |
| CVE-2026-107817 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versio | Medium 4.4 | 9 Oct 2026 |
| CVE-2026-107818 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment | High 8.4 | 9 Oct 2026 |
| CVE-2026-107815 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code e | High 8.5 | 9 Oct 2026 |
| CVE-2026-107814 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an a | High 8.4 | 9 Oct 2026 |
| CVE-2026-48163 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shel | High 8.0 | 12 Jun 2026 |
| CVE-2026-48165 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This | High 8.0 | 12 Jun 2026 |
| CVE-2026-44168 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shel | High 8.0 | 12 Jun 2026 |
| CVE-2026-44169 | MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2. | Medium 4.3 | 12 Jun 2026 |
| CVE-2026-44170 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell command | Medium 6.3 | 12 Jun 2026 |
| CVE-2026-44171 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the | Medium 6.3 | 12 Jun 2026 |
| CVE-2026-44172 | MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in | Medium 6.9 | 12 Jun 2026 |
| CVE-2026-44173 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11. | Medium 5.0 | 12 Jun 2026 |
| CVE-2026-49261 | MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should | Critical 10.0 | 11 Jun 2026 |
| CVE-2026-35549 | An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca. | Medium 6.5 | 3 Apr 2026 |
| CVE-2026-32710 | MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environ | High 8.5 | 20 Mar 2026 |
| CVE-2026-3494 | In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged. | Medium 5.3 | 3 Mar 2026 |
| CVE-2025-56404 | An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation. | High 7.5 | 10 Sep 2025 |
| CVE-2023-26785 | MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "create function" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed. | Critical 9.8 | 17 Oct 2024 |
| CVE-2023-39593 | Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed. | Medium 5.6 | 17 Oct 2024 |
| CVE-2024-27766 | An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed. | Medium 5.7 | 17 Oct 2024 |
| CVE-2023-22084 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or fre | Medium 4.9 | 17 Oct 2023 |
| CVE-2023-5157 | A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service. | High 7.5 | 27 Sep 2023 |
| CVE-2023-40354 | An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, but this password is then stored in cleartext in the resulting .cnf file under /var/lib/maxscale/maxscale.cnf.d. The fixed versions are 2.5.28, 6.4.9, 22.08.8, and 23.02.3. | Medium 6.5 | 14 Aug 2023 |
| CVE-2022-47015 | MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer. | Medium 6.5 | 20 Jan 2023 |
| CVE-2022-21595 | Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequentl | Medium 4.4 | 18 Oct 2022 |
| CVE-2022-38791 | In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock. | Medium 5.5 | 27 Aug 2022 |
| CVE-2022-32091 | MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc. | High 7.5 | 1 Jul 2022 |
| CVE-2022-32081 | MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc. | High 7.5 | 1 Jul 2022 |
| CVE-2022-32082 | MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc. | High 7.5 | 1 Jul 2022 |
| CVE-2022-32083 | MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker. | High 7.5 | 1 Jul 2022 |
| CVE-2022-32084 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select. | High 7.5 | 1 Jul 2022 |
| CVE-2022-32085 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor. | High 7.5 | 1 Jul 2022 |
| CVE-2022-32086 | MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field. | High 7.5 | 1 Jul 2022 |
| CVE-2022-32087 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args. | High 7.5 | 1 Jul 2022 |
| CVE-2022-32088 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort. | High 7.5 | 1 Jul 2022 |
| CVE-2022-32089 | MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level. | High 7.5 | 1 Jul 2022 |
| CVE-2022-31621 | MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability w | Medium 5.5 | 25 May 2022 |
| CVE-2022-31622 | MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero value) while executing the method create_worker_threads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a | Medium 5.5 | 25 May 2022 |
| CVE-2022-31623 | MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and | Medium 5.5 | 25 May 2022 |
| CVE-2022-31624 | MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lock_bigbuffer is not released correctly, which allows local users to trigger a denial of service due to the deadlock. | Medium 5.5 | 25 May 2022 |
| CVE-2022-21451 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequent | Medium 4.4 | 19 Apr 2022 |
| CVE-2022-21427 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequ | Medium 4.9 | 19 Apr 2022 |
| CVE-2022-27448 | There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc. | High 7.5 | 14 Apr 2022 |
| CVE-2022-27449 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148. | High 7.5 | 14 Apr 2022 |
| CVE-2022-27451 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc. | High 7.5 | 14 Apr 2022 |
| CVE-2022-27452 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc. | High 7.5 | 14 Apr 2022 |
| CVE-2022-27455 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c. | High 7.5 | 14 Apr 2022 |
| CVE-2022-27456 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc. | High 7.5 | 14 Apr 2022 |
| CVE-2022-27457 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c. | High 7.5 | 14 Apr 2022 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview MariaDB ships as the default mysql package in Debian, Red Hat and most other distributions, which puts it under a very large share of self-hosted web applications and managed cloud databases. It holds the application's users and its business records, so a defect in privilege checking or in the authentication plugins is a full read of that. The MariaDB Foundation runs a HackerOne vulnerability disclosure programme that offers thanks and reputation points and states it gives no compensation, and the Vector Bounty is a feature contest rather than a security reward. sorona.xyz pays you directly on qualified, reproduced findings. In scope The Foundation accepts reports through its HackerOne disclosure programme or at [email protected] , and states it runs no bug bounty and pays nothing. The declared surface is the server the project releases, with nothing narrower carved out The SQL parser and the optimiser, including every rewrite the optimiser performs on a query before it runs The privilege system in full: GRANT evaluation, roles, column and table level privileges, and the definer semantics on views, stored routines, triggers and events The authentication plugins the tree ships, covering mysql_native_password, ed25519, unix_socket, PAM, GSSAPI and the pluggable authentication interface itself The client and server wire protocol, the handshake in front of it and the capability negotiation a client can drive Every storage engine shipped in the tree, including InnoDB, Aria, MyISAM, MyRocks, ColumnStore, Spider, CONNECT and FederatedX Replication end to end: the binary log formats, GTID handling, semi-synchronous replication and the Galera integration The engines and functions that make outbound connections or read the filesystem, in particular CONNECT, FederatedX, Spider and LOAD DATA LOAD DATA LOCAL INFILE and the client-side file handling a server can request through it User-defined functions, the plugin loading path and anything that loads a shared object into the server process TLS configuration, certificate verification and the encryption of both client connections and replication links The JSON functions, dynamic columns, and the character set and collation conversion paths information_schema , performance_schema and the system tables, and what a low-privileged account can read from them The client tools the project ships, including mysqldump, mariabackup and the command line client Out of scope MariaDB plc's enterprise builds and SkySQL, which are the commercial company's products with their own reporting path MySQL, Percona Server and other forks, each with its own vendor and process Distribution packaging, init scripts and distro-specific patches rather than upstream MariaDB A privilege an administrator deliberately granted, such as FILE or SUPER to an account that should not have had it Connectors and client libraries maintained outside the server repository Upstream libraries the server links, unless MariaDB's own use of them is what makes the defect reachable Most-valued findings Privilege escalation through the grant system, above all definer-context execution in views, stored routines, triggers and events, where code runs as an account the caller does not hold Authentication bypass in any plugin or in the handshake, since the plugin is what decides identity before any privilege check happens Memory corruption reachable from the wire protocol before authentication completes, which needs nothing but network access to the port Parser and optimiser defects that crash or corrupt the server from a query an ordinary user is permitted to run LOAD DATA LOCAL INFILE handling, where a server the client did not expect requests a file from the client's own filesystem Outbound connection engines, CONNECT, FederatedX and Spider, reaching internal network services from a table definition a user can create Storage engine defects in InnoDB page, undo or redo log handling reachable from a restore, a replica feed or a crash recovery Replication paths where a replica accepts events from a source it should not trust, or where binary log content executes with more privilege than the originating statement had Information disclosure through information_schema , performance_schema or error messages that reveal data across an account boundary The research names CVE-2021-26086 as having gone through this programme without describing it. Treat the published record as thin rather than as evidence the surface is clean Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through the MariaDB Foundation vulnerability disclosure programme on HackerOne, or by email to [email protected] The Foundation states that it does not have a bug bounty program and gives no compensation. HackerOne thanks, reputation points and occasional swag are the whole reward The Vector Bounty is a feature-development contest for LLM framework integrations. It is not a security reward and filing a vulnerability against it is a category error Give the exact statement, the account's grants and the server version. Privilege findings here almost always turn on the grants held rather than on an unusual build Name the storage engine and the authentication plugin. The tree ships several of each and a defect in one rarely exists in the others State whether the finding needs FILE, SUPER or a similarly powerful privilege. A grant that already permits reading the filesystem is a deliberate administrative decision Disclosure Coordinated with the MariaDB Foundation security team through HackerOne or the security address, with a CVE issued and the fix shipped in the maintenance releases across supported series. MariaDB coordinates with distributions that carry it as the default database, so the practical embargo runs to those releases rather than to a fixed day count. Hold detail until the fixed versions are out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability