CVE-2026-119210
Description
A flaw was found in MariaDB Connector/J. This vulnerability can lead to information disclosure when client-side local file handling is enabled. A compromised database server or a machine-in-the-middle attacker can provide crafted database or table identifiers that bypass filename validation checks during query or metadata operations. As a result, the attacker can force the client application to transmit arbitrary readable files from the host system.
Statement
This vulnerability is rated as Moderate severity because successful exploitation requires an attacker to control a rogue database server or perform active network interception against database connections. In standard Red Hat deployments, Java applications connect to authenticated backend database instances across protected internal networks, which restricts exposure. Although an attacker in this position could read client-side files accessible to the application process, the flaw does not allow modifying data or executing code.
Mitigation
Disable the local file transfer feature by setting the `allowLocalInfile` connection option to `false` in the JDBC connection configuration.
In the JDBC connection string, append the property:
jdbc:mariadb://<host>:<port>/<database>?allowLocalInfile=false
Or set the parameter in application datasource properties:
properties
allowLocalInfile=false
Additionally, ensure TLS with server certificate validation (such as `sslMode=verify-full`) is configured to protect against machine-in-the-middle tampering.
Caveats:
Disabling this option prevents the application from executing `LOAD DATA LOCAL INFILE` commands to transfer client files to the database.
Warning: Modifying database connection parameters requires restarting the dependent application or service for changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
The regexp could accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can allow dangerous substrings to bypass the intended protection.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
