CVE-2026-49261

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

CRITICAL

9.8

CVSS Score

Published: June 11, 2026 at 05:13 PM UTC

Updated: October 26, 2026 at 11:10 AM UTC

1 product affected across 1 vendorMariaDB

Using server by MariaDB?

Get instant alerts when new vulnerabilities affect server - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploit prediction

EPSS 2%

SSVC

No known exploit

Description

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

MariaDB · Mariadbnpm

95%

10.11.1 ≤ v < 10.11.1810.6.1 ≤ v < 10.6.2711.4.1 ≤ v < 11.4.1211.8.1 ≤ v < 11.8.812.3.1 = 12.3.1

Affected range stops below 10.11.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 10.6.27, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.4.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.8.8, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw

References (15)

x_refsource_CONFIRMVendor Advisory

Source: cverecord

https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw

x_refsource_MISCIssue Tracking

Source: cverecord

https://jira.mariadb.org/browse/MDEV-39721