CVE-2026-49261: MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-11 · updated 2026-10-26
Weakness: CWE-78

Description

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

Affected products

MariaDB: from 10.6.1 before 10.6.27; from 10.11.1 before 10.11.18; from 11.4.1 before 11.4.12; from 11.8.1 before 11.8.8; 12.3.1 — fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8

How to fix

Upgrade to a fixed version: MariaDB 10.6.27, 10.11.18, 11.4.12, 11.8.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-49261 or the next vulnerability affects your stack