In MariaDB Server versions through 11.8.5, enabling the server audit plugin with filtering of DCL, DDL, or DML events allows an authenticated user to prefix a statement with double‑hyphen or hash comments. Because the audit subsystem ignores any statement that begins with a comment, that statement is omitted from audit records, creating a potential audit log bypass.

Settings apply to MariaDB Server up to version 11.8.5, the MariaDB Foundation product, and Amazon deployments that embed this server such as Amazon Aurora MySQL, Amazon RDS for MariaDB, and Amazon RDS for MySQL. No fixed version is identified in the data.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an authenticated user could use the comment bypass to conceal database operations from audit logs, potentially enabling stealthy activity. The overall risk is considered moderate because the CVSS rating and the low EPSS score offset the potential impact that could be achieved if exploited.