CVE-2026-49261NVD

Vulnerability Summary

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

Severity Level

CRITICAL(10.0)

Published Date

Jun 11, 2026

Last Modified

Aug 12, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

1.58%Probability

Root Weakness (CWE)

CWE-78: OS Command Injection ↗

The software constructs all or part of an OS command using externally-influenced input, but does not properly neutralize special elements.

CVSS v3.1 Base Metrics — Score 10.0 (CRITICAL)

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

Affected & Patched Versions

Affected Versions

Mariadb Mariadb >= 10.6.1 and < 10.6.27
Mariadb Mariadb >= 10.11.1 and < 10.11.18
Mariadb Mariadb >= 11.4.1 and < 11.4.12
Mariadb Mariadb >= 11.8.1 and < 11.8.8
Mariadb Mariadb

Patched Versions

Mariadb Mariadb 10.6.27
Mariadb Mariadb 10.11.18
Mariadb Mariadb 11.4.12
Mariadb Mariadb 11.8.8

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.