CVE-2026-85985

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85985
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-85985.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-85985
Aliases
Downstream
BELL (1)
DEBIAN (1)
ECHO (1)
RHSA (2)
Published
2026-10-16T16:21:14Z
Modified
2026-10-22T16:40:11Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
MariaDB: Unauthorized file access via CONNECT engine UDFs
Details

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85985.json"
}
References

Affected packages

Git / github.com/mariadb/server

Affected ranges

Type
GIT
Repo
https://github.com/mariadb/server
Events
Introduced
00a8357bd30fdfca23720448a3f638290b6d35b7
Fixed
210ab6edf47fa73f3b77e974ed2e9357ccdd051c
Introduced
2437674291f31c91869a74eb6ebd9f03dc52bd43
Fixed
93e051860a9c7e87ee8cee6ed38b640d491f7170
Introduced
fa69b085b10f19a3a8b6e7adab27c104924333ae
Fixed
170b1d70737be6f134448f51713cdc1ae215b420
Introduced
1c4aed7c680c0402d6e97e097f03815c0e9bf4c5
Fixed
bf9193a939f515e95dd8def1a5468088c91cede6
Introduced
21a0714a118614982d20bfa504763d7247800091
Fixed
83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e
Introduced
7f923870722c5d382e16d56af526d1ee4e03f987
Fixed
620a4b5624222048fece7fe1789978ae0675cae2
Fixed
4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "10.6.1"
                },
                {
                    "fixed": "10.6.28"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "10.11.1"
                },
                {
                    "fixed": "10.11.19"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "11.4.1"
                },
                {
                    "fixed": "11.4.13"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "11.8.1"
                },
                {
                    "fixed": "11.8.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "12.3.1"
                },
                {
                    "fixed": "12.3.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "13.0.1"
                },
                {
                    "fixed": "13.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "mariadb-10.11.19",
            "range": [
                {
                    "fixed": "93e051860a9c7e87ee8cee6ed38b640d491f7170"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "mariadb-10.6.28",
            "range": [
                {
                    "fixed": "210ab6edf47fa73f3b77e974ed2e9357ccdd051c"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "mariadb-11.4.13",
            "range": [
                {
                    "fixed": "170b1d70737be6f134448f51713cdc1ae215b420"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "mariadb-11.8.9",
            "range": [
                {
                    "fixed": "bf9193a939f515e95dd8def1a5468088c91cede6"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "mariadb-12.3.3",
            "range": [
                {
                    "fixed": "83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "mariadb-13.0.2",
            "range": [
                {
                    "fixed": "620a4b5624222048fece7fe1789978ae0675cae2"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

mariadb-10.*
mariadb-10.6.1
mariadb-10.6.10
mariadb-10.6.11
mariadb-10.6.12
mariadb-10.6.13
mariadb-10.6.14
mariadb-10.6.16
mariadb-10.6.17
mariadb-10.6.18
mariadb-10.6.19
mariadb-10.6.2
mariadb-10.6.20
mariadb-10.6.21
mariadb-10.6.22
mariadb-10.6.23
mariadb-10.6.24
mariadb-10.6.25
mariadb-10.6.26
mariadb-10.6.27
mariadb-10.6.3
mariadb-10.6.4
mariadb-10.6.5
mariadb-10.6.6
mariadb-10.6.8
mariadb-10.6.9
mariadb-11.*
mariadb-11.4.1
mariadb-11.4.10
mariadb-11.4.11
mariadb-11.4.11b
mariadb-11.4.2
mariadb-11.4.3
mariadb-11.4.4
mariadb-11.4.5
mariadb-11.4.6
mariadb-11.4.7
mariadb-11.4.8
mariadb-11.4.9
mariadb-11.8.1
mariadb-11.8.2
mariadb-11.8.3
mariadb-11.8.4
mariadb-11.8.6
mariadb-11.8.7
mariadb-11.8.7b
mariadb-12.*
mariadb-12.3.1
mariadb-13.*
mariadb-13.0.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-85985.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "339712868486696881928202886484344029960",
            "length": 1715
        },
        "id": "CVE-2026-85985-1cd3e8db",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e",
        "target": {
            "file": "sql/log_event_server.cc",
            "function": "Rows_log_event_fragmenter::fragment"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "51538197006448953915320670849158504811",
            "length": 1872
        },
        "id": "CVE-2026-85985-339ade49",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe",
        "target": {
            "file": "storage/connect/bsonudf.cpp",
            "function": "bfile_make"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "174666140590871606901473999763629558781",
            "length": 1498
        },
        "id": "CVE-2026-85985-4c3f0cde",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe",
        "target": {
            "file": "storage/connect/bsonudf.cpp",
            "function": "bson_file"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "171216773621675811000547289823354805620",
            "length": 1207
        },
        "id": "CVE-2026-85985-4f031624",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe",
        "target": {
            "file": "storage/connect/bsonudf.cpp",
            "function": "bbin_file"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "127916986096898777617617736281859907014",
            "length": 1502
        },
        "id": "CVE-2026-85985-500d8fb6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe",
        "target": {
            "file": "storage/connect/jsonudf.cpp",
            "function": "jbin_file"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "265577632303887446289749120585557906012",
                "90338461107598051749602183626527029076",
                "135974257990159682542061181314070611477",
                "59440921527566409168742990730026725636",
                "871135494022066138858656571240698570",
                "247293449498909397416026347351022219912",
                "179396894775406735805665784479451940140",
                "269443033021460921618747189093528286356",
                "259691733175197008076763079871985256069",
                "102338916828131457031608538914692707050",
                "65381815336936246662830619643818353906",
                "7100122396357284882133944108516856108",
                "161393146120866756988306743699529625075"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85985-6d62851c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6",
        "target": {
            "file": "sql/item_vectorfunc.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "16792576655940462211639639962295085845",
            "length": 1495
        },
        "id": "CVE-2026-85985-77108977",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe",
        "target": {
            "file": "storage/connect/jsonudf.cpp",
            "function": "json_file"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "71765076455992845495603733103049780326",
                "132468216307321099313474528141472164219",
                "335104987168281452340257267070229799939",
                "120856499846470636191643553421775300179",
                "266852371692492258927372331806428738665",
                "53555819227876951841873484659785190308",
                "254998287201458333169381003665812377865",
                "182581397748951836543531983394635579463",
                "41083194844292017487014649926821159026",
                "135591222975876619629644299378804531663",
                "259433981832853299446593849105920851007",
                "298218725377229319765890297238519131402",
                "340056685524719056880338168855694856743",
                "122339160352136500079256377464086248635",
                "238024095887820003104130944620284587419",
                "7830341983059510323793940240927348311",
                "162912216835241415915754248202873951845",
                "150361554933327464172574693705812571981",
                "119916133982168928837148136908469466330",
                "47640077213070997469095494059971947874",
                "25712118322514378612707765649994426002",
                "101449567833529954249637585070994316710",
                "17897826500101088564491970597224714924"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85985-912b43d1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe",
        "target": {
            "file": "storage/connect/jsonudf.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "244324594461433554125325936895563264854",
            "length": 1796
        },
        "id": "CVE-2026-85985-9286bb9f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe",
        "target": {
            "file": "storage/connect/jsonudf.cpp",
            "function": "jfile_make"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "19396654230727680862231874232577326830",
            "length": 1414
        },
        "id": "CVE-2026-85985-96fb114a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/210ab6edf47fa73f3b77e974ed2e9357ccdd051c",
        "target": {
            "file": "sql/sql_acl.cc",
            "function": "sp_revoke_privileges"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "73617688475456381632237133958511949829",
            "length": 361
        },
        "id": "CVE-2026-85985-c0933a1f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/bf9193a939f515e95dd8def1a5468088c91cede6",
        "target": {
            "file": "sql/item_vectorfunc.cc",
            "function": "Item_func_vec_fromtext::fix_length_and_dec"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "138670767569041361813718827546500861828",
                "327352541066467771703787476014134557589",
                "53052602935476390831583314750681766722",
                "226497441160131621809579909316313981354",
                "266852371692492258927372331806428738665",
                "53555819227876951841873484659785190308",
                "254998287201458333169381003665812377865",
                "49746933461266227605020761995586309179",
                "406035043658892995448339968673257055",
                "53976655320527440774298789905523879059",
                "325875844305542448445907678193496496932",
                "325874974574524942517095799311151223390",
                "186883866576677539495002692268579220386",
                "17897826500101088564491970597224714924"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85985-c92ba8fe",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe",
        "target": {
            "file": "storage/connect/bsonudf.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "78729389804100571106228155026799037698",
            "length": 1047
        },
        "id": "CVE-2026-85985-d81404d8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe",
        "target": {
            "file": "storage/connect/jsonudf.cpp",
            "function": "jbin_file_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "171922335289695664967320282302097012127",
                "314879264303882873216162120692739820747",
                "296657960952465744719770094395708912555",
                "28908880241426286725700820784852115102"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85985-e432b228",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e",
        "target": {
            "file": "sql/log_event_server.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "183641122820527899892205997373469390336",
                "12095135203163139841028791777804307677",
                "261887274333923489567884393156281229573",
                "19596961056601881646204718953590518429",
                "25158190267319178375799434564910426458",
                "79868031186840623159971036872671971261",
                "200778640584501115234958299261030732588",
                "131021480572983927965383857652169015703",
                "259210579588990591926922975771411684670",
                "308293174102341777206582901688760031968",
                "89478837310948837990084826679872794784",
                "338867660209294619394468737325384824268",
                "65149555481557669088217935797404683315",
                "105820217938288583399134742620391383975",
                "267805393157920367530703819131918882708",
                "38039493077906535068223160253483389044",
                "155248208230518966475406644089911097304",
                "209055380163172280650138201893193615240",
                "272836316798595100180885698601052815062",
                "139632117011298755459574139848637089730",
                "112587756624072824044503235660869015796",
                "209449771227581042596611529590064743564",
                "56162312170597687179668831370098686864",
                "315300952757613979287910862404135586893",
                "124631588903503696531604192284802908081",
                "198447588607325890124688444202645428954",
                "277625244959498228703902376649148264741",
                "330117756961362545716991630961872097576",
                "261593920518145687707482140334066129492",
                "310029719624151742354329969579957852433",
                "127355466400457567574110878344968834572",
                "234782324348854453769025645027188821308",
                "4933798797732149183640097703596172566",
                "78315220821823291688255278082772905562",
                "283495978258419445643401192492072153310",
                "289680889044596507883491876189615178669",
                "77013134991366103256989980017263461542"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-85985-ebba965d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mariadb/server/commit/210ab6edf47fa73f3b77e974ed2e9357ccdd051c",
        "target": {
            "file": "sql/sql_acl.cc"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T16:40:11Z"