mariadb.com
External Program
Submit bugs directly to this organization
External Program
Submit bugs directly to this organization
Current MariaDB customers may report a security concern by creating a support case in the [https://support.mariadb.com/](Customer Support Portal).
Non-customers may report a security concern by emailing [email protected]
For the MariaDB Foundation’s policy on reporting security concerns, please see [https://hackerone.com/mariadb?type=team](MariaDB Foundation Reporting Procedures).
MariaDB asks that reports provide full details of the security concern so our security team can validate and reproduce the issue.
In-Scope: MariaDB plc Developed Software Products and Services including (API’s, binaries, MariaDB Cloud)
Out-of-Scope: Third-party services, partner products, physical security, DoS attacks, social engineering
To help us address your report efficiently, please include the following information:
The environment (operating system, hardware, and MariaDB version, including plugins and storage engines).
Code affected, along with your explanation of the faulty behavior.
Configuration details, including SQL tables, queries, and network actions required to reproduce the behavior.
Core dumps, stack-traces, error logs, data dumps, failed test cases or network packets required to diagnose or reproduce the attack.
Proof of Concept (PoC) code that successfully triggers/exploits the vulnerability in at least one given scenario.
Technical reproduction details, such as:
The specific URL or endpoint affected
The parameters or payloads to be sent
The type of request (e.g., GET, POST, PUT, DELETE, etc.)
Any headers or authentication context required to reproduce the issue
Binary/Package command line parameters
Software or service affected
Module name or parameter
Video demonstrating the vulnerability
Exclusions List
Automated scanner findings without PoC
DoS/DDoS attacks
Social engineering
Missing security headers without exploitability
Self-XSS
Known vulnerabilities
Vulnerability reports need to be documented in a way that they can be reproduced, easily understood, and classified. The more details you provide, including screenshots, sample code, or short videos; the faster our team can understand and address the issue.
MariaDB considers security research conducted consistent with this policy to be “authorized” conduct and will not pursue legal action against security researchers who:
Act in good faith and in accordance with this policy;
Perform security research within the scope defined in this policy;
Do not access, modify, or exfiltrate data beyond what is strictly necessary to demonstrate a vulnerability. If user data is encountered, the security researcher must stop immediately and report it;
Comply with all applicable laws;
Do not cause harm or disruption to MariaDB services or users (e.g., DoS attacks); and
Report vulnerabilities responsibly and maintain confidentiality until the issue is resolved.
**Third Parties: **please understand that MariaDB cannot authorize research on third-party infrastructure (e.g., hosting providers) and cannot limit their legal rights.
To all customer and security researchers who follow this MariaDB Vulnerability Reporting Policy, our security team commits to:
Respond in a timely manner, acknowledging receipt of your report
Provide an estimated time frame for addressing the vulnerability
Notify the reporting individual when the vulnerability has been fixed
We take security issues seriously and will endeavor to respond swiftly to fix verifiable security issues.
While we appreciate the work done by independent security researchers, we do not offer compensation for reporting a security vulnerability.