MariaDB

Multiple vulnerabilities in MariaDB Connector libraries enable remote, unauthenticated attackers to perform SQL injection, bypass security controls, and manipulate sensitive database content.

The MariaDB connector for Node.js (CVE-2026-55215) inadvertently sends database credentials during the handshake process before server identity is validated, enabling cleartext credential theft by an active man-in-the-middle.

eduMFA versions prior to 2.9.1 are vulnerable to token reusage due to incorrect InnoDB snapshot isolation in MySQL and MariaDB versions prior to 11.6.2 (or newer with innodb_snapshot_isolation=off), affecting token types such as TOTP, HOTP, and likely WebAuthN, where tokens are intended for single use, requiring racing the transaction for exploitation.

A remote, authenticated attacker can exploit a vulnerability in MariaDB to perform a denial of service attack and potentially execute arbitrary program code.

This rule detects the use of database dumping utilities to exfiltrate data from a database on Linux systems, where attackers may attempt to dump the database to a file and then exfiltrate the file to a remote server.