CVE-2026-44170: MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

Synopsis

Argument injection in the MariaDB CONNECT engine's REST support on Windows allows an authenticated database user to inject arbitrary arguments into an underlying curl command line. The vulnerability is reachable over the network and requires only a low-privilege database account. Successful exploitation gives the attacker full remote code execution on the server, with high impact on confidentiality, integrity, and availability across the scope boundary. Patched-image rebuilds at versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The MariaDB service must be reachable over the network; an attacker connects remotely to issue the malicious table definition.

• AuthenticationRequired

  A low-privilege MariaDB account is sufficient; no administrative rights are needed to define a CONNECT REST table and trigger the injection.

• Victim interactionNot required

  No victim action is needed; the attacker exercises the injection entirely through their own authenticated session.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, memory layout dependency, or special environmental state is required.

Blast Radius

• Reads any file accessible to the MariaDB service account on the Windows host, including stored credentials, configuration files, and database data files.
• Writes or modifies files on the server filesystem within the service account's permissions, enabling persistent backdoors or corruption of database files.
• Executes arbitrary operating system commands on the server, allowing lateral movement, privilege escalation attempts, or exfiltration of the entire database.
• Crashes or disrupts the MariaDB service and dependent applications by terminating processes or corrupting critical files.