CVE-2026-49261

CRITICAL

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

Title source: cna
STIX 2.1

Description

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

References (2)

Core 2
Core References
X_Refsource_Misc x_refsource_misc
https://jira.mariadb.org/browse/MDEV-39721

Scores

CVSS v3 10.0
EPSS 0.0060
EPSS Percentile 43.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-78
Status published
Products (5)
MariaDB/server = 12.3.1
MariaDB/server >= 10.11.1, < 10.11.18
MariaDB/server >= 10.6.1, < 10.6.27
MariaDB/server >= 11.4.1, < 11.4.12
MariaDB/server >= 11.8.1, < 11.8.8
Published Jun 11, 2026
Tracked Since Jun 11, 2026