---
id: CVE-2026-3494
title: MariaDB Server Audit Plugin Comment Handling Bypass
summary: >-
  In MariaDB server version through 11.8.5, when server audit plugin is enabled
  with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or
  QUERY_DML filtering, if an authenticated database user invokes a SQL statement
  prefi…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-778
vendor: MariaDB Foundation
product: MariaDB Server
affected:
  - mariadb_server < 10.6.25
  - mariadb_server < 10.11.16
  - mariadb_server < 11.4.10
  - mariadb_server < 11.8.6
  - aurora_mysql < 2.12.6
  - aurora_mysql < 3.04.6
  - aurora_mysql < 3.10.3
  - aurora_mysql < 3.11.1
  - rds_for_mysql < 5.7.44-RDS.20260212
  - rds_for_mysql < 8.0.45
  - rds_for_mysql < 8.4.8
  - rds_for_mariadb < 10.6.25
  - rds_for_mariadb < 10.11.16
  - rds_for_mariadb < 11.4.10
  - rds_for_mariadb < 11.8.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-03T18:56:25.959459Z'
exploitAvailable: true
published: '2026-03-03'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T18:24:15.745Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-3494'
references:
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-006-AWS/'
  - url: >-
      https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261
  - url: >-
      https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff
tags:
  - cve.org
  - exploit-available
epss: 0.00381
epssPercentile: 0.30617
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Kelnor/CVE-2026-3494_Verfication'
  checkedAt: '2026-10-20T19:16:49.569Z'
ingestedAt: '2026-10-20T19:16:14.550Z'
---

## Overview

In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

## Affected

- `mariadb_server < 10.6.25`
- `mariadb_server < 10.11.16`
- `mariadb_server < 11.4.10`
- `mariadb_server < 11.8.6`
- `aurora_mysql < 2.12.6`
- `aurora_mysql < 3.04.6`
- `aurora_mysql < 3.10.3`
- `aurora_mysql < 3.11.1`
- `rds_for_mysql < 5.7.44-RDS.20260212`
- `rds_for_mysql < 8.0.45`
- `rds_for_mysql < 8.4.8`
- `rds_for_mariadb < 10.6.25`
- `rds_for_mariadb < 10.11.16`
- `rds_for_mariadb < 11.4.10`
- `rds_for_mariadb < 11.8.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.