{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_mariadb/el8/vex/2026/cve-2026-107818-els_mariadb-el8.json" } ], "tracking": { "current_release_date": "2026-10-28T13:45:06Z", "generator": { "date": "2026-10-28T13:45:06Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-107818-ELS_MARIADB-EL8", "initial_release_date": "2026-10-09T18:17:00Z", "revision_history": [ { "date": "2026-10-09T18:17:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-28T13:45:06Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-107818" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 8", "product": { "name": "Community Enterprise Operating System 8", "product_id": "CentOS-8", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "MariaDB-s3-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-s3-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-s3-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-s3-engine@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-devel-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-devel-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-devel-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-devel@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-cracklib-password-check-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-cracklib-password-check-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-cracklib-password-check-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-cracklib-password-check@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-gssapi-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-gssapi-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-gssapi-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-gssapi-server@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-columnstore-engine-0:10.6.28_6.4.121-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-columnstore-engine-0:10.6.28_6.4.121-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-columnstore-engine-0:10.6.28_6.4.121-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-columnstore-engine@10.6.28_6.4.121-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-rocksdb-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-rocksdb-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-rocksdb-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-rocksdb-engine@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-backup-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-backup-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-backup-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-backup@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-connect-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-connect-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-connect-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-connect-engine@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-client-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-client-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-client-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-client@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-common-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-common-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-common-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-common@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-test-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-test-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-test-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-test@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-server@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-oqgraph-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-oqgraph-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-oqgraph-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-oqgraph-engine@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "MariaDB-shared-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product": { "name": "MariaDB-shared-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_id": "MariaDB-shared-0:10.6.28-1.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/MariaDB-shared@10.6.28-1.el8.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "MariaDB-s3-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-s3-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-s3-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-devel-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-devel-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-devel-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-cracklib-password-check-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-cracklib-password-check-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-cracklib-password-check-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-gssapi-server-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-gssapi-server-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-gssapi-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-columnstore-engine-0:10.6.28_6.4.121-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-columnstore-engine-0:10.6.28_6.4.121-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-columnstore-engine-0:10.6.28_6.4.121-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-rocksdb-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-rocksdb-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-rocksdb-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-backup-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-backup-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-backup-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-connect-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-connect-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-connect-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-client-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-client-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-client-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-common-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-common-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-common-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-test-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-test-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-test-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-server-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-server-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-oqgraph-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-oqgraph-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-oqgraph-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "MariaDB-shared-0:10.6.28-1.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:MariaDB-shared-0:10.6.28-1.el8.tuxcare.els1.x86_64" }, "product_reference": "MariaDB-shared-0:10.6.28-1.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-107818", "cwe": { "id": "CWE-15", "name": "External Control of System or Configuration Setting" }, "notes": [ { "category": "description", "text": "MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-8:MariaDB-backup-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-client-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-columnstore-engine-0:10.6.28_6.4.121-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-common-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-connect-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-cracklib-password-check-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-devel-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-gssapi-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-oqgraph-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-rocksdb-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-s3-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-shared-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-test-0:10.6.28-1.el8.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-mariadb/cve/CVE-2026-107818" }, { "category": "external", "summary": "https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e", "url": "https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e" }, { "category": "external", "summary": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19", "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19" }, { "category": "external", "summary": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28", "url": "https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28" }, { "category": "external", "summary": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13", "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13" }, { "category": "external", "summary": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9", "url": "https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9" }, { "category": "external", "summary": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3", "url": "https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3" }, { "category": "external", "summary": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2", "url": "https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2" }, { "category": "external", "summary": "https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5", "url": "https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5" }, { "category": "external", "summary": "https://jira.mariadb.org/browse/MDEV-40629", "url": "https://jira.mariadb.org/browse/MDEV-40629" } ], "release_date": "2026-10-09T18:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-20T11:52:20.875364Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-mariadb/releases/CLSA-2026:1787226739", "product_ids": [ "CentOS-8:MariaDB-backup-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-client-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-columnstore-engine-0:10.6.28_6.4.121-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-common-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-connect-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-cracklib-password-check-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-devel-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-gssapi-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-oqgraph-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-rocksdb-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-s3-engine-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-server-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-shared-0:10.6.28-1.el8.tuxcare.els1.x86_64", "CentOS-8:MariaDB-test-0:10.6.28-1.el8.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els-mariadb/releases/CLSA-2026:1787226739" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }