Daily Digest
The most urgent database issue is the stack‑buffer‑overflow in MariaDB’s CONNECT engine (CVE‑2026-107815, CVSS 8.5 HIGH), which allows an authenticated user with access to the CONNECT engine to crash the server and potentially achieve remote code execution; patching to the fixed MariaDB releases is the priority.
Summary: In MariaDB server versions 10.6.1‑10.6.28, 10.11.1‑10.11.19, 11.4.1‑11.4.13, 11.8.1‑11.8.9, 12.3.1‑12.3.3, and 13.0.1‑13.0.2, the CONNECT engine’s DOS table type performs an incorrect boundary check, permitting a one‑byte null write beyond a stack buffer at an attacker‑controlled offset. An authenticated user who can use the CONNECT engine can trigger a crash and possibly remote code execution.
Affected Features / Interoperability: The CONNECT storage engine; impacts any functionality relying on that engine (e.g., federated tables, specific ODBC/JDBC connectors). Replication, backup, or client‑driver operations that use CONNECT‑based tables could fail or be exploited.
Source:
Actions:
Summary: In the same version ranges, MariaDB RPM packages set the mysql service account’s home directory to the database data directory. A user with the FILE privilege could write dot‑files (e.g., .bash_profile) into $HOME, which would execute when an administrator logs in as the mysql account, leading to privilege escalation. Debian packages are unaffected.
Affected Features / Interoperability: Service account configuration for the mysql system user; affects any administrative login or automation that relies on the mysql account’s environment.
Source:
Actions:
Summary: In the affected releases, the mariadb.service unit references /run/mysqld/wsrep-new-cluster on restart. A user with the FILE privilege and permission to write to /run/mysqld (via secure‑file‑priv) can create that file and inject arbitrary environment variables into the restarted service, potentially leading to privilege escalation or code execution.
Affected Features / Interoperability: Systemd service unit for MariaDB; impacts service startup, clustering (Galera/Wsrep), and any automation that depends on the service environment.
Source:
Actions:
Summary: MariaDB Connector/Node.js versions 3.2.0‑3.2.5, 3.3.4, 3.4.7, and 3.5.4 improperly handle the permitSetMultiParamEntries option: attacker‑controlled object keys containing backticks can escape identifier quoting and be interpreted as SQL, allowing unintended column updates or arbitrary SQL execution when the option is enabled.
Affected Features / Interoperability: Node.js applications using mariadb-connector-nodejs with permitSetMultiParamEntries enabled; impacts any data‑access layer that builds dynamic SET clauses.
Source:
Actions:
Summary: In the same version ranges, insufficient validation of FRM metadata fields (counts, offsets, lengths) allows an attacker who can place a crafted FRM file in the data directory to trigger out‑of‑bounds reads/writes, crash the server, or potentially achieve code execution.
Affected Features / Interoperability: Table definition (.frm) file parsing; affects DDL operations, table opening, and any tool that reads FRM files (e.g., mysqlcheck, mysqldump).
Source:
Actions:
Summary: The view FRM parser fails to safely encode embedded newline characters in usernames. A user with CREATE USER and CREATE VIEW WITH GRANT OPTION can craft a username containing newlines that the parser misinterprets as security metadata, potentially leading to privilege escalation.
Affected Features / Interoperability: Username handling in CREATE VIEW statements; impacts any feature that relies on correct parsing of user‑defined identifiers (e.g., view‑based security models).
Source:
Actions:
Summary: The qc_info plugin can be confused by queries containing embedded null bytes. Reading INFORMATION_SCHEMA.QERY_CACHE_INFO after such a query is cached may read past the end of a heap buffer, possibly disclosing adjacent memory or crashing the server.
Affected Features / Interoperability: Query cache info plugin; impacts monitoring tools that query INFORMATION_SCHEMA.QERY_CACHE_INFO.
Source:
Actions:
Summary: The ACL cache may generate identical keys for role and localhost usernames when both have an empty IP component, allowing a user with CREATE USER to create a colliding principal and inherit another account’s cached privileges.
Affected Features / Interoperability: Internal ACL caching mechanism; impacts privilege checking for role‑based and host‑based accounts.
Source:
Actions:
Summary: MariaDB Connector/C versions 3.4.1‑3.4.10 perform TLS hostname verification after checking certificate trust, allowing a man‑in‑the‑middle with a valid certificate for another hostname to downgrade authentication to mysql_clear_password and capture the client password.
Affected Features / Interoperability: TLS authentication switch in the C/C++ connector; impacts any application using libmariadb with Zero‑Configuration SSL.
Source:
Actions:
Summary: The mysql_json plugin assumes imported MySQL tables contain valid binary JSON data; malformed JSON can cause out‑of‑bounds reads, information disclosure, or server crash.
Affected Features / Interoperability: mysql_json plugin; impacts any workflow that imports external MySQL tables via this plugin.
Source:
Actions:
Summary: IBM Guardium Data Protection 12.0‑12.2 contains a heap‑based buffer overflow in its MongoDB protocol parser. A remote attacker can send an overly long SCRAM username to trigger memory corruption, possibly leading to denial of service or arbitrary code execution.
Affected Features / Interoperability: MongoDB protocol parsing within Guardium; affects monitoring and protection of MongoDB traffic.
Source:
Actions:
(Note: The above news items are unverified chatter and should be treated as community discussion rather than authoritative advisories.)
The most urgent item is the critical severity flaw in the openPDC Docker image (CVE-2026-105278, CVSS 9.8) which exposes a hard‑coded administrative credential allowing any network‑reachable attacker to gain full administrative control of the application; this outranks all other findings due to its confirmed high impact and lack of authentication requirement.
Summary: Improper input validation in Apache Camel Karavan allows an authenticated user of any role to have Karavan apply arbitrary Kubernetes resources (including privileged pods, hostPath volumes, etc.) to the cluster without restricting resource kinds or namespace.
Affected Features / Interoperability: Karavan plugin’s resource‑apply functionality; successful exploitation can lead to host‑level privileges, privilege escalation, and potential cluster compromise affecting workloads, replication, and any downstream services relying on the cluster.
Source:
Actions:
Summary: Command injection in Argo CD’s repo-server when processing an SSH Git repository configured with a malicious proxy URL; shell metacharacters in the proxy host/port are not neutralized, allowing execution of arbitrary commands as the repo-server process.
Affected Features / Interoperability: Argo CD repo-server component handling SSH Git repositories; exploitation can lead to theft of Git, Helm, and OCI credentials and compromise of CI/CD pipelines.
Source:
Actions:
Summary: In Backstage’s @backstage/plugin-kubernetes-backend, the deprecated Kubernetes services endpoint insufficiently validates entity data, letting an authenticated user with Kubernetes read permissions retrieve metadata for workloads outside their intended scope.
Affected Features / Interoperability: Deprecated Kubernetes services endpoint in the Backstage plugin; impact is limited to read‑only disclosure of Kubernetes object metadata across configured clusters, which could aid further attacks.
Source:
Actions:
Summary: The official Docker image for openPDC ships with a fixed administrative credential that is not changed on first use; an attacker with network reach to the management interface can log in with these credentials and obtain full administrative control of the application.
Affected Features / Interoperability: openPDC management interface exposed via the Docker image; compromise can lead to complete control of the openPDC service, data manipulation, and potential pivot to other infrastructure.
Source:
Actions:
Summary: Docker Desktop for Windows versions prior to 4.92.0 fail to verify the signature of a package supplied to `docker desktop installer.exe install -package`, allowing an attacker who can convince a user to approve a malicious package to execute arbitrary installer actions with LocalSystem privileges.
Affected Features / Interoperability: Docker Desktop Installer.exe package installation functionality; exploitation yields LocalSystem code execution on the host, compromising the underlying system and any containers or services running thereon.
Source:
Actions: