{
  "threat_severity" : "Moderate",
  "public_date" : "2026-06-12T17:31:53Z",
  "bugzilla" : {
    "description" : "mariadb: MariaDB server: Information disclosure of stored routine definitions due to insufficient privilege check",
    "id" : "2488467",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2488467"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-266",
  "details" : [ "MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.", "A flaw was found in MariaDB server. A user who has been granted EXECUTE access to a stored routine through a role can view the definition of that routine. This information disclosure occurs even if the user does not possess the `SHOW CREATE ROUTINE` privilege, potentially exposing sensitive routine logic. This vulnerability allows for unauthorized access to routine definitions." ],
  "statement" : "Moderate: MariaDB server, as shipped in Red Hat products, is affected by an information disclosure flaw. A user granted EXECUTE access to a stored routine through a role can view the routine's definition without possessing the SHOW CREATE ROUTINE privilege. This is considered Moderate as it requires existing privileges and only exposes routine logic, not arbitrary code execution or data manipulation.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-06-30T00:00:00Z",
    "advisory" : "RHSA-2026:33412",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "mariadb11.8-3:11.8.8-1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-06-30T00:00:00Z",
    "advisory" : "RHSA-2026:33481",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "mariadb:11.8-9080020260612104015.rhel9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25143",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "mariadb11-8-main-11.8.8-1.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25145",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "mariadb10-11-main-10.11.18-1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "mariadb10.11",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "mariadb",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "mariadb:10.11/mariadb",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "mariadb:10.3/mariadb",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "mariadb",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "mariadb:10.11/mariadb",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-44169\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44169\nhttps://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2\nhttps://jira.mariadb.org/browse/MDEV-39288" ],
  "name" : "CVE-2026-44169",
  "csaw" : false
}