CVE-2026-49261
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
A vulnerability in MariaDB Server allows execution of arbitrary shell commands embedded in the joiner node name when `wsrep_notify_cmd` is enabled. Affected versions: 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1.
Risk Assessment
An attacker can take over the database server by injecting malicious commands into the node name, leading to full system compromise and potential data breach.
Recommendation
Upgrade MariaDB to versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2 immediately. If upgrade is not possible, disable `wsrep_notify_cmd`.
Original NVD description (English source)
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.