kelnor/cve-2026-3494_verficationReproduces and analyzes CVE-2026-3494, an audit logging bypass in MariaDB server_audit plugin, using Docker-based multi-version testing to compare logging behavior across vulnerable and patched versions.
This project provides a specialized environment to verify and analyze a potential audit logging bypass in the MariaDB server_audit plugin when specific inline comments (#, --) are used within SQL queries.
SET PASSWORD with comments or Error 1046 cases) fail to be recorded in the audit log in MariaDB v11.8.6, which was previously considered a patched version.#) might cause DCL statements to be improperly processed or ignored by the auditor.server_audit is enabled with filters such as QUERY_DCL, QUERY_DDL, and QUERY_DML, certain queries containing inline comments may bypass the logging mechanism.The following matrix summarizes the observed logging behavior during testing:
[MariaDB 10.3.39 / 11.8.5]
- CASE #1, #2A, #2B, #3, #4 → All LOGGED (Normal behavior)
[MariaDB 11.8.6 (Target Version)]
- CASE #2B (Error 1046) → NOT LOGGED (Logging Omission) ❗
- CASE #3 (Commented SET PASSWORD) → NOT LOGGED (Logging Omission) ❗
- CASE #1, #2A, #4 → LOGGED (Normal behavior)
This project utilizes Docker Compose to run three isolated MariaDB instances:
| Version | Port | Status | Description |
|---|---|---|---|
| MariaDB 10.3.39 | 3306 | Vulnerable | Legacy stable version verification |
| MariaDB 11.8.5 | 3307 | Vulnerable | Latest vulnerable version verification |
| MariaDB 11.8.6 | 3308 | Target | Evaluation of recent audit logging changes |
Build and start the MariaDB containers. The environment automatically configures the server_audit plugin and initializes test users.
# Build and start containers
docker compose up --build -d
# Verify container status
docker ps
Install the required Python dependencies:
pip install pymysql
The script can be executed from any directory within the project.
python poc/poc.py
The PoC performs 5 distinct scenarios:
SET PASSWORD command with an embedded # comment (Bypass check).SELECT statement with an embedded # comment (Bypass check).LOGGED: The query was successfully recorded in the audit log.NOT LOGGED: The query was omitted from the log (Potential bypass or regression).>> Actual Log: Displays the raw entry from server_audit.log in blue to verify the integrity of the recorded statement.Below are the actual execution logs showing the difference between the expected behavior (11.8.5) and the logging omission (11.8.6).
[+] TEST_CASE_2_B_ERROR_1046
Result: LOGGED
>> Actual Log: | 20260504 04:45:05,...,QUERY,mysql,'SELECT * FROM user',1046
[+] TEST_CASE_3_COMMENT_SET_PASSWORD
Result: LOGGED
>> Actual Log: | 20260504 04:45:07,...,QUERY,mysql,'SET PASSWORD # CVE-2026-3494 Test ...',1133
[+] TEST_CASE_2_B_ERROR_1046 (No database selected)
Result: NOT LOGGED <-- Omission detected
[+] TEST_CASE_3_COMMENT_SET_PASSWORD (Inline Comment #)
Result: NOT LOGGED <-- Omission detected
[!TIP] For the complete terminal output of all test cases and versions, refer to the Full Execution Log.
.
├── config/ # MariaDB server_audit configuration
├── init/ # Initialization scripts (User & Plugin setup)
├── logs/ # Audit log volume mounts
├── poc/
│ └── poc.py # Automated verification script
├── results/
│ └── full_execution_log.md # Detailed terminal output logs
├── docker-compose.yml # Multi-version environment definition
└── README.md # Project documentation (Current file)
This project is for educational and security research purposes only. Use it responsibly and do not apply these configurations to production environments without thorough testing.