CVE-2026-49261
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk58th percentile — higher than 58% of all known CVEs
Summary
A vulnerability in MariaDB Server allows execution of arbitrary shell commands embedded in the joiner node name when `wsrep_notify_cmd` is enabled. Affected versions range from 10.6.1 to 12.3.1.
Risk Assessment
An attacker can take over the database server by injecting malicious commands into the node name, leading to full system compromise and potential data breach.
Recommendation
Upgrade MariaDB immediately to versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2. If upgrade is not possible, disable `wsrep_notify_cmd`.
Original NVD description (English source)
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.