openSUSE Ships MariaDB Update Closing 22 Database Vulnerabilities on Tumbleweed
openSUSE has published advisory openSUSE-SU-2026:12245-1, a moderate-rated update that resolves 22 separate vulnerabilities in the MariaDB packages shipped on openSUSE Tumbleweed GA media. The fixed build is 12.3.2-3.1, and it covers the full package set: mariadb, mariadb-client, mariadb-galera, mariadb-tools, mariadb-test, mariadb-bench, mariadb-errormessages, mariadb-rpm-macros, libmariadbd19 and libmariadbd-devel. The cross-referenced issues include CVE-2026-85748, CVE-2026-92262 and CVE-2026-97380, each carrying a SUSE CVSS v3.1 score of 8.8, and CVE-2026-86047, scored 8.0 under CVSS v3.1 and 8.9 under CVSS v4.0. The remainder range from CVE-2026-61081 at 2.7 up through the 107814 to 107823 cluster in the 4.3 to 8.6 band. Any Tumbleweed host running a MariaDB server, a Galera cluster node, or software built against the embedded libmariadbd library is in scope.
The advisory is a consolidated package announcement and does not publish per-CVE root cause detail, proof-of-concept code, or exploitation mechanics, so no attack chain can be stated as fact here. What the published CVSS vectors do describe is the shape of the exposure. The majority are network-reachable issues requiring an authenticated database session: CVE-2026-85748, CVE-2026-92262, CVE-2026-97380 and CVE-2026-85985 all show AV:N with PR:L, meaning a low-privileged account is sufficient, with high confidentiality and integrity consequences. Another group, including CVE-2026-107821, CVE-2026-107823, CVE-2026-60585 and CVE-2026-47023, requires high privileges and would most plausibly be reached through a compromised administrative or service account. A smaller set is local only, such as CVE-2026-60331 and CVE-2026-60747, the latter needing no privileges at all but limited to availability loss on the host.
Database servers rarely sit at the edge, but they hold the data everything else depends on, and the privilege thresholds in this set are low enough to matter. An attacker who has already obtained any ordinary application database credential, through a leaked connection string or a web application flaw, lands in the exact position several of these issues assume. The Galera package is included in the fix list, so clustered deployments inherit the same exposure across every node, and the libmariadbd-devel and libmariadbd19 entries mean third-party software embedding the MariaDB server library carries the flaws independently of the standalone server. On current exploitation status, FIRST EPSS places all twelve CVEs with published scores below two percent probability of exploitation in the next thirty days, the highest being CVE-2026-107815 at 1.4 percent and CVE-2026-107821 at 1.2 percent, with CVE-2026-107817 and CVE-2026-60331 lowest at 0.2 percent. No exploitation in the wild is reported in the advisory, and none of these CVEs is cited as being used in active campaigns. The remaining ten CVEs in the advisory have no published exploitation data, which is an absence of evidence rather than evidence of safety.
Attack Surface
Database, Server OS
Tactics
Initial Access, Privilege Escalation, Impact, Collection
Techniques
- T1190 – Exploit Public-Facing Application
- T1068 – Exploitation for Privilege Escalation
- T1499 – Endpoint Denial of Service
- T1213 – Data from Information Repositories
SuperPRO's Threat Countermeasures Procedures
- Update every openSUSE Tumbleweed host to MariaDB 12.3.2-3.1 with `zypper refresh && zypper update mariadb mariadb-client mariadb-galera mariadb-tools libmariadbd19 libmariadbd-devel`, then confirm with `rpm -q mariadb libmariadbd19`, which must report 12.3.2-3.1 or later.
- Patch Galera cluster members one node at a time rather than as a single batch, since mariadb-galera 12.3.2-3.1 is part of the same fix set and every node carries the same 22 CVEs until updated.
- Restrict TCP/3306 and the Galera ports 4567, 4568 and 4444 to named application subnets using firewalld rich rules; most of the issues in this advisory are AV:N and require only a reachable listener plus a valid session.
- Review MariaDB grants with `SELECT user, host FROM mysql.global_priv;` and `SHOW GRANTS` for each account, and strip SUPER, FILE, PROCESS and CREATE privileges from application service accounts, as CVE-2026-107821, CVE-2026-107823, CVE-2026-60585 and CVE-2026-47023 all require PR:H.
- Enable the server_audit plugin in /etc/my.cnf.d/ and alert on repeated unexpected mysqld restarts or crash entries via `journalctl -u mariadb`, which is the observable signature of the availability-only issues such as CVE-2026-60747 and CVE-2026-60184.
- Identify in-house or third-party software linked against the embedded server library libmariadbd19 and rebuild it against 12.3.2-3.1, because an application bundling the older library stays vulnerable even after the standalone server is updated.
- Track the SUSE CVE pages for the advisory set, starting with CVE-2026-85748, CVE-2026-92262 and CVE-2026-97380, for score revisions or newly published exploitation detail that would change the patch window from scheduled to urgent.
