MariaDB security findings
your auditor will accept

A scoped MariaDB security audit by senior DBAs against published control sets. We review privileges, authentication, TLS, data-at-rest encryption, server_audit logging, CVE posture, and Galera and MaxScale configuration. Every finding maps directly to compliance standards with clear severity and remediation paths.

Book a scoping call → See what the report contains →

Reviewed on Clutch 4.9 Verified client reviews

<15 min S1 RESPONSE SLA

300+ CLIENTS SUPPORTED

6000+ SERVERS MANAGED

10+ yrs MARIADB IN PRODUCTION

Credentials we hold ISO 27001 ISO 9001 PCI DSS Attestation MariaDB Foundation Sponsor Senior MariaDB DBAs

Brands that trust Mydbops

What the audit examines

The surfaces where findings actually live

Senior MariaDB DBAs inspect privileges, encryption, audit logging, and your Galera/MaxScale topology for actionable architectural risks.

Access control & privilege structure

We map all users, active grants, host restrictions, and dormant accounts into a repeatable privilege matrix, flagging excessive SUPER or ALL PRIVILEGES permissions.

We review authentication hardening including unix_socket for local admins, ed25519, roles, and enterprise PAM, LDAP, or GSSAPI integrations.

privilege matrix · unix_socket · ed25519 · PAM / LDAP / GSSAPI · role design

Encryption, in transit and at rest

In transit: We evaluate TLS enforcement via require_secure_transport, cipher suite strength, certificate rotation, and encrypted Galera/replication inter-node traffic.

At rest: We verify InnoDB tablespace, binary log, and redo log encryption, auditing key custody plugins (file_key_management, AWS KMS, HashiCorp Vault) for plaintext gaps.

require_secure_transport · cipher policy · file_key_management · KMS / Vault

Audit logging an assessor will accept

We verify that server_audit and SERVER_AUDIT_EVENTS capture required compliance evidence without risking log drops or query latency.

We inspect off-host log shipping, address Amazon RDS MARIADB_AUDIT_PLUGIN constraints, and clarify whether MariaDB Enterprise Audit is necessary.

server_audit · SERVER_AUDIT_EVENTS · off-host shipping · RDS MARIADB_AUDIT_PLUGIN

Galera and MaxScale as audit surfaces

For Galera clusters, we assess wsrep encryption, SST/IST transfer exposure, plaintext wsrep_sst_auth credentials, and donor node isolation.

For MaxScale proxies, we review admin REST API authentication, listener exposure, query firewall filters, and column data-masking rules.

wsrep encryption · SST / IST · wsrep_sst_auth · gcache at rest · MaxScale admin / REST

Book a scoping call →

Framework	Control	MariaDB artefact we produce
PCI DSS 4.0	3.5.1 / 3.5.1.2	Tablespace and binary log encryption state, key custody, and what remains in cleartext
PCI DSS 4.0	7.2.4	A repeatable GRANT extract and a documented privilege review
PCI DSS 4.0	8.3 / 8.6.x	Service account inventory, authentication plugin posture, credentials out of config files
PCI DSS 4.0	10.2 / 10.4.1.1	server_audit event coverage, off-host shipping, and failure detection
ISO 27001:2022	A.8.15, A.8.16	Log coverage mapped to Annex A clause numbers
ISO 27001:2022	A.8.24	TLS enforcement, cipher policy, key management
GDPR	Art. 32(1)(c)	Tested restores with a measured RTO and RPO, not a documented intention
GDPR	Art. 32(1)(d)	Why a recurring database review is an obligation, not discretionary spend
India DPDP 2025	Rule 6(1)(a)	Column encryption and masked non-production copies
India DPDP 2025	Rule 6(1)(c), 6(1)(e)	Audit log configuration and retention
RBI IT 2023	Para 19, Para 26	Privileged access review; independent assessment evidence
HIPAA	§164.312(a)(1), (b)	Unique user identification and a demonstrable audit mechanism

The Center for Internet Security publishes two MariaDB benchmarks: MariaDB 10.11 v1.0.0 and MariaDB 10.6 v1.1.0. There is no CIS Benchmark for MariaDB 11.4, 11.8 or 12.3.

If you run 10.6 or 10.11 we assess against the benchmark directly, Level 1 and Level 2, and the report carries a conformance table. If you run 11.x or 12.x we map the controls that still apply, derive the rest from MariaDB's own published PCI and STIG guidance, and mark every derived item as derived. You will always be able to tell which findings come from a published benchmark and which come from our judgement.

Series	GA	Community EOL	RDS standard support ends
10.5	n/a	24 Jun 2025	31 Aug 2026 (passed)
10.6 LTS	6 Jul 2021	6 Jul 2026 (passed)	31 Dec 2026
10.11 LTS	16 Feb 2023	16 Feb 2028	Feb 2028
11.4 LTS	29 May 2024	29 May 2029	May 2029
11.8 LTS	4 Jun 2025	4 Jun 2028	Jun 2028
12.3 LTS	28 May 2026	12 Jun 2029	Jun 2029

We check your exact build against the MariaDB advisory record rather than handing you a generic list. For scale: CVE-2026-49261 carries a CVSS score of 10.0 and was fixed in 11.8.8, 11.4.12, 10.11.18 and 10.6.27, published 11 June 2026. CVE-2026-48163 and CVE-2026-48165 both score 8.0 and were fixed in the same releases. A further four advisories landed on 21 July 2026, fixed in 12.3.3, 11.8.9, 11.4.13, 10.11.19 and 10.6.28.

The report gives you the advisories your build is exposed to, the minimum version that closes each, and an upgrade path that accounts for whether you can take an in-place upgrade or need a rolling Galera upgrade.

Your effort, bounded

What the audit costs you in effort

The work on your side is small and bounded, and it is written into the statement of work before anything begins.

Step	Who	Your time
Scoping call	You and the lead DBA	45 min
Read-only access provisioning	Your DBA or platform team	30 min
Collection and review	Mydbops	None
Report and live walkthrough	You, your security owner, our engineer	60 min
Remediation	Optional, separate engagement	Scoped separately

Scope is bounded in the statement of work: one MariaDB deployment, standalone or a single Galera cluster. Multi-cluster and multi-region estates are quoted separately. Implementation is not included, and that is deliberate.

Book a scoping call →

What lands in your inbox

A report built to be handed over

Eight artefacts, each written so the person reading it: an executive, a DBA, or an assessor: can act on it without asking you what it means.

1

Executive summary

Written for the person who will not read the rest.

2

Findings register

Each finding with a severity, the affected hosts, and the control it answers to.

3

CIS conformance table

Level 1 and Level 2, with derived items marked as derived.

4

CVE & version exposure sheet

The minimum fixed version and an upgrade path for your exact build.

5

Privilege matrix

Extractable and repeatable, so your next review is cheaper than this one.

6

Galera & MaxScale review

Where they are in scope.

7

Remediation roadmap

Split into 0-30 days, 1-6 months, and 6-24 months.

8

Live walkthrough

With the engineer who did the work, not an account manager.

Every finding ships with its severity and a coverage column: the control it answers to and the hosts it affects.

Why not just scan it

You can scan MariaDB for free. Here is what the scan will not tell you.

A scanner tells you which checks failed. It cannot tell you that a privilege exists because a nightly job needs it, that a node is exposed because of an SST method chosen three years ago by someone who has left, or that your audit configuration passes its check while recording nothing your assessor will accept.

It also cannot tell you which of its four hundred findings matters on Tuesday. Every finding in our report has been looked at by a DBA who can explain why it is a risk in your architecture specifically: and several of them will be things no scanner has a check for.

How we handle your data

Read-only, non-destructive, under NDA

NDA before access

A mutual NDA is signed before access is even discussed. Credentials are never sent over email or chat.

Least-privilege, read-only

We work from a read-only account with the minimum grants the checks require, over a channel you control. No schema changes, no writes; load-bearing collection comes from a replica or scheduled with you first.

Your data stays yours

We do not copy application data out of your environment. What we retain is configuration, privilege and log metadata: and in the scoping call we tell you exactly what leaves your network and how long we keep it.

Proof

Teams that trust Mydbops with the database layer

Stability & DR

...enhancing the stability and disaster recovery of our critical services, supporting over 100,000 customers across Spain and Europe.

Teresa

Product Owner, Hosting & Email · CDMON

Production partnership

Mydbops has been a reliable DBA partner for our production database, supporting our growing traffic with monthly optimization reports, query tuning, and automated backups.

Henry Suryawirawan

VP of Engineering · Flip

24/7 at scale

Mydbops has been a reliable partner for Shiprocket, expertly managing our critical databases with round-the-clock support. Their team of database specialists ensures seamless operations 24/7. Highly recommended for businesses of all sizes.

Sunil Kumar

CTO · Shiprocket

Capability

Exceeded all expectations! Mydbops team performed our migration in just 24 hours (where others had quoted this as a 2 - 4 week project). Their services were the most cost-effective by far, and their skill set, performance, and quality are unmatched. We will be retaining this team for ongoing 24/7 server monitoring and support.

Anthony Peck

Co-Founder & CTO · Astoria

Audit logging

Frequently asked questions

MariaDB security audit, answered

A structured review of a running MariaDB estate against a published control set. We examine privileges and authentication, encryption in transit and at rest, audit logging, network exposure, version and CVE posture, and the security of your Galera and MaxScale layer if you run them. You receive a written report in which every finding is tied to a control your auditor recognises, given a severity, and placed on a remediation schedule.

Yes, and we are specific about where CIS stops. The Center for Internet Security publishes benchmarks for MariaDB 10.11 (v1.0.0) and MariaDB 10.6 (v1.1.0) only. There is no CIS Benchmark for 11.4, 11.8 or 12.3. If you run an 11.x or 12.x estate, we map against the 10.11 benchmark where the control still applies and tell you which items we derived rather than inherited. Any vendor claiming a CIS-certified 11.x audit is extrapolating without saying so.

The report is built to be handed over. Findings carry the control reference an assessor will ask for: PCI DSS 4.0 requirements 3, 7, 8 and 10; ISO 27001:2022 Annex A.8.15 and A.8.16; GDPR Article 32(1)(c) and 32(1)(d); India DPDP Rules 2025 Rule 6; RBI IT Directions 2023 where they apply. We are not your assessor and cannot issue an attestation. What we produce is the database-layer evidence your assessor is asking you for.

10.5, 10.6, 10.11, 11.4, 11.8 and 12.3, on bare metal, in VMs, in containers, and on Amazon RDS for MariaDB. Two dates matter right now. Community MariaDB 10.6 reached end of life on 6 July 2026. On Amazon RDS, MariaDB 10.5 left standard support on 31 August 2026 and 10.6 leaves it on 31 December 2026. If you are on either, the version itself is now a finding.

We check your exact build against the MariaDB advisory record and report what applies to you, not a generic list. As an illustration of why this matters, CVE-2026-49261 carries a CVSS score of 10.0 and was fixed in 11.8.8, 11.4.12, 10.11.18 and 10.6.27, published on 11 June 2026. The report tells you which advisories your build is exposed to, the minimum version that closes each one, and the upgrade path, including whether an in-place upgrade or a rolling Galera upgrade is appropriate.

Yes. We review whether server_audit is loaded, what it is configured to record, whether the events captured match what your framework requires, whether logs are shipped off-host, and whether log loss would be detected. On Amazon RDS there is a specific trap: the MARIADB_AUDIT_PLUGIN option cannot be turned off once added, only removed, and the default event set is CONNECT and QUERY, which is usually narrower than an assessor expects. We also tell you whether community server_audit is sufficient for your requirement or whether you would need MariaDB Enterprise Audit, which is a paid feature.

Yes, and as a system rather than as a set of servers. For Galera we look at wsrep traffic encryption, SST and IST transfer security, the SST method and the credentials it uses, donor node exposure, and whether the gcache is protected at rest. For MaxScale we look at admin interface exposure, REST API authentication, masking filter coverage, and whether the firewall filter rules actually cover the statements they are believed to cover. A cluster is only as secure as the node with the weakest configuration, and in practice that is rarely the one anyone checks.

No. Collection is read-only. We request a least-privilege account, we run no schema changes and no writes, and heavy collection is taken from a replica or a backup restore where one exists. If any step would place measurable load on a primary, we tell you before we run it and ask you to schedule it.

A mutual NDA is signed before access is discussed. We work from a read-only account with the minimum grants the checks require, over a channel you control. Credentials are never sent over email or chat. We do not copy application data out of your environment. The evidence we retain is configuration, privilege and log metadata, and we tell you in the scoping call exactly what will leave your network.

An executive summary written for someone who will not read the rest. A findings register with severity, affected hosts and the control each finding answers to. A CIS conformance table. A CVE and version exposure sheet with a patch plan. A privilege matrix. A Galera and MaxScale review where applicable. A remediation roadmap split into 0 to 30 days, 1 to 6 months and 6 to 24 months. And a live walkthrough with the engineer who did the work.

A scanner tells you which checks failed. It does not know that a privilege is there because a batch job needs it, that a node is exposed because of an SST method chosen three years ago, or that your audit configuration technically passes while recording nothing your assessor will accept. Every finding in our report has been looked at by a DBA who can explain why it is a risk in your architecture, and several of them will be things no scanner has a check for.

The audit is a review, not an intervention, and we keep the two separate on purpose so that the findings stay independent. Most clients take the roadmap and engage Mydbops consulting or managed services to execute it. Where we do the remediation, we re-check the closed findings and issue a delta report so that you have written evidence the finding is closed.

The effort on your side is small and bounded: a 45 minute scoping call, about 30 minutes to provision read-only access, nothing during collection and review, and a 60 minute walkthrough when the report lands. We agree the report date in the scoping call and it goes in the statement of work.

Senior MariaDB DBAs from the Mydbops database engineering team, not generalists and not an offshore review desk. Mydbops is a MariaDB Foundation sponsor, runs ISO 27001 and ISO 9001 certified processes, and holds a PCI DSS Attestation of Compliance as a service provider. Those are certifications we hold. They are separate from the standards we audit you against, which are listed above.

Let's talk

Turn "we think it is secure" into evidence your assessor accepts

A 45-minute scoping call with a senior MariaDB DBA maps your estate, versions and frameworks to a bounded statement of work: read-only, non-destructive, under NDA.