Patching and independently verifying MariaDB after CVE-2026-107814
A successful MariaDB package update does not finish the CVE-2026-107814 response by itself. Administrators should verify the service account's home, confirm the deployed package branch, and determine whether a malicious shell profile could already have been written.
Vulnerability overview
MariaDB rates the RPM-specific $HOME flaw 8.4 High. The vulnerable package set the mysql account's home to the data directory. A user with FILE privilege could write dot-files there, and the advisory describes execution through .bash_profile when an administrator uses su - mysql -s /bin/bash. Debian's /nonexistent home is not affected.
Mechanism
The fixing commit changes account creation and applies usermod to an existing mysql account. That detail matters because package management may preserve a user entry created by an earlier release. After deploying a fixed package, verify the effective passwd entry with getent passwd mysql. Check that the home is not the data directory and that mariadbd cannot write to the replacement location.
Exploitation conditions
Version evidence must include the package format. The advisory's affected RPM ranges are 10.6.1 to 10.6.27, 10.11.1 to 10.11.18, 11.4.1 to 11.4.12, 11.8.1 to 11.8.8, 12.3.1 to 12.3.2, and 13.0.1. Fixed releases are 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. The 10.6 branch is end of life, so organizations should plan an upgrade to a maintained branch.
Impact
The response should include a grant review for FILE and a check for unexpected hidden files in the data directory. If an administrator can start a shell as mysql, local audit records and shell history may help. Investigators should distinguish a plausible indicator from proof of exploitation; the advisory does not report a specific victim or exploitation campaign.
Affected products and scope
The vendor workaround is to change the mysql home to a path the database cannot write, such as /nonexistent. Use usermod, verify the passwd result, and document the exception until the fixed package is deployed. A manual account change should be held to the same configuration-management standard as a package update so that a later deployment does not silently restore the vulnerable setting.
Exposure context
A ZoomEye Search for app="MariaDB" returned 5,154,203 product-fingerprint matches, while the CVE filter for vul.cve="CVE-2026-107814" returned zero. The product count is useful for estimating the size of an inventory, but it does not identify the package format, software version, FILE grants, local accounts, or administrator login behavior needed to establish actual exposure.
Operational checks
A completion record should contain more than the ticket status. Record the fixed package, the verified account home, the FILE-grant review, the hidden-file check and any exception. For a fleet, sample systems across image families, upgrade paths and configuration-managed groups because one successful host does not represent every deployment. Re-run the check after the next image refresh. If evidence suggests prior shell execution, handle the host through incident response rather than closing the patch ticket before the investigation.
Remediation and verification
After patching, verify the account and package together, inspect for startup files, and review privileged database access. Repeat the checks in backups and rebuilt images. If there is evidence of a shell profile or unexplained mysql execution, follow incident response procedures, preserve relevant files and timestamps, and rotate credentials accessible to the database service account.
