CVE-2026-44169: MariaDB Stored Routine Access Control Bypass

Technical summary

CVE-2026-44169 is an improper access control vulnerability (CWE-863) in MariaDB's role-based privilege model. When a role grants EXECUTE permission on a stored routine (procedure or function), the routine definition becomes visible to users with that role assignment, despite the absence of SHOW CREATE ROUTINE privilege on their account. This occurs because the access control check for viewing routine definitions does not properly validate whether the user has direct SHOW CREATE ROUTINE permission versus inherited execution-only access through a role. The vulnerability is present in MariaDB 11.4.1–11.4.10, 11.8.1–11.8.6, and version 12.3.1. Patched versions are 11.4.11, 11.8.7, and 12.3.2.

Business impact

The exposure of stored routine definitions can reveal business logic, database design patterns, embedded credentials or API keys, and proprietary algorithms. In regulated environments (healthcare, finance, PCI-DSS), unauthorized access to routine code may constitute a compliance violation. The practical impact depends on routine content—if routines contain hard-coded secrets, third-party integrations, or security-sensitive logic, the exposure amplifies downstream risk. This is particularly concerning in multi-tenant or role-delegated environments where DBAs intend to compartmentalize access.

Affected systems

MariaDB server versions 11.4.1 through 11.4.10, 11.8.1 through 11.8.6, and 12.3.1 are affected. Organizations running these specific versions with stored routines and role-based access controls are in scope. Later patch versions (11.4.11, 11.8.7, 12.3.2) contain the fix. Versions outside these ranges are not affected by this particular issue.

Exploitability

Exploitation requires existing database login credentials (authenticated attacker). The CVSS 3.1 score of 4.3 reflects low attack complexity and local attack surface once authenticated. An attacker needs only standard SQL query capability to view routine definitions; no special tools or zero-day techniques are required. The barrier to exploitation is user access to the database, not technical sophistication. In environments with overly permissive role assignments or shared credentials, exposure risk is elevated.

Remediation

Upgrade MariaDB to patched versions: 11.4.11 or later for the 11.4 line, 11.8.7 or later for the 11.8 line, or 12.3.2 or later for the 12.3 line. Test patches in non-production environments first, especially if applications depend on specific routine behavior. After patching, review role assignments and SHOW CREATE ROUTINE privilege grants to ensure alignment with security policy. Consider revoking unnecessary EXECUTE permissions on sensitive routines in the interim.

Patch guidance

Plan upgrades within your standard maintenance windows. Backup databases before applying patches. Test failover and replication scenarios post-patch if your deployment includes high-availability configurations. Verify no application logic depends on the previous (incorrect) behavior where roles granted implicit routine visibility. Check release notes for any deprecations or behavior changes in each patch version.

Detection guidance

Query the INFORMATION_SCHEMA.ROUTINES table to list all stored procedures and functions in your database. Cross-reference against SHOW GRANTS output for each user and role to identify which users have EXECUTE permission through roles but lack explicit SHOW CREATE ROUTINE privilege. Audit access logs for any SELECT queries against information_schema or SHOW CREATE ROUTINE statements executed by users who should not have routine visibility. In security monitoring, flag any user account receiving EXECUTE-only role membership when handling sensitive routines.

Why prioritize this

While the CVSS score is moderate (4.3), the vulnerability should be prioritized based on the sensitivity of routine content and the principle of least privilege. Organizations with strict code-as-intellectual-property policies, compliance mandates around code visibility, or routines containing secrets or business logic should patch sooner. High-priority targets include financial systems, healthcare databases, and multi-tenant SaaS platforms. Lower-priority candidates are development/test environments or databases with non-sensitive routine contents.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) is calculated from network-accessible attack surface (AV:N), low attack complexity (AC:L), requirement for low privilege authentication (PR:L), no user interaction needed (UI:N), and a confidentiality impact limited to the confidentiality of routine definitions (C:L). Integrity and availability are unaffected (I:N, A:N). The score appropriately reflects that this is a controlled information disclosure rather than a critical system compromise, but emphasizes that mitigation depends on the business sensitivity of routine contents.

Frequently asked questions