MariaDB Audit Plugin Bypass: Comments Hide SQL Queries
MariaDB Server and Amazon RDS/Aurora MySQL have a security issue (CVE-2026-3494) where SQL statements prefixed with comments (-- or #) skip audit logging when the server_audit_events filter is active. This affects MariaDB through 11.8.5, Aurora MySQL through 3.10.2, and RDS MySQL/MariaDB across multiple versions. If you're running these databases with audit logging enabled, update immediately—authenticated users could hide their database activity.
source: [aws/security-bulletin]