MariaDB 10.6.28

Final Flag Lowered — MariaDB 10.6.28 dropped on August 13, 2026, and it's the last release of the 10.6 series. A Stable (GA) build, a long-term branch's send-off, and a security patch worth reading.

Security Squeeze

Two runtime-editable system variables — wsrep_sst_auth (MDEV-40027) and wsrep_node_address (MDEV-40056) — could let a privileged user (SUPER or SYSTEM_VARIABLES_ADMIN) run shell commands as the mariadbd process UID. Both are now properly sanitized. Patch those Galera nodes.

Super-Sized Galera

• No more silent cleartext SST — when SST encryption is configured but cannot actually be established, rsync and mariabackup now abort with an error instead of quietly sending the donor's data unencrypted (MDEV-28233).
• Role-based TLS certs — SST can use different certs, keys, and CAs depending on node role, with eight new [sst] options overriding the generic ssl-* settings (MDEV-23744).

Engine Escapades

• InnoDB — race conditions fixed in INFORMATION_SCHEMA views innodb_trx, innodb_locks, and innodb_lock_waits (MDEV-39344).
• CSV — DELETE on a CSV table could crash the server; now it won't (MDEV-40636).
• ARCHIVE — REPAIR no longer destroys TEXT data (MDEV-24245).
• MyISAM — crash on corrupted MYI files with invalid keyseg length is fixed (MDEV-39816).
• RocksDB — 32-bit size truncation addressed (MDEV-39812).
• Mroonga — CHECK TABLE after engine switch no longer crashes (MDEV-39556).
• CONNECT — SAST warnings fixed; file UDFs honor secure_file_priv; REST can pass curl arguments; a double(255,50) DOS-table crash is resolved.

Admin Asides

Overlong database names in GRANT statements are no longer silently truncated to 64 chars (MDEV-39047), single quotes in SHOW CREATE USER are handled (MDEV-40308), and dynamic column reads can't overflow that shift counter (MDEV-40200).

10.6 is done after this one — if you're still on the branch, start mapping your way to 10.11 or 11.4. It was a good run.