CVE-2026-49261

EUVD-2026-36269

11.06.2026, 18:16

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

OS Command Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	10 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 69%

Affected Products (NVD)

Vendor	Product	Version
mariadb	mariadb	10.6.1 ≤ 𝑥 < 10.6.27
mariadb	mariadb	10.11.1 ≤ 𝑥 < 10.11.18
mariadb	mariadb	11.4.1 ≤ 𝑥 < 11.4.12
mariadb	mariadb	11.8.1 ≤ 𝑥 < 11.8.8
mariadb	mariadb	12.3.1

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Enterprise Linux 10	3:10.11.18-1.el10_2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 10	3:11.8.8-1.el10_2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8	8100020260616102001.489197e6 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	9080020260612104015.rhel9 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	9080020260612103452.rhel9 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Hardened Images	11.8.8-1.hum1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Hardened Images	10.11.18-1.hum1 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

mariadb

bookworm	1:10.11.18-0+deb12u1 fixed
forky	1:11.8.8-1 fixed
sid	1:11.8.8-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

mariadb

jammy	dne
noble	needs-triage
questing	ignored
resolute	Fixed 1:11.8.6-5ubuntu0.1 released

mariadb-10.0

jammy	dne
noble	dne
questing	dne
resolute	dne

mariadb-10.1

bionic	needs-triage
jammy	dne
noble	dne
questing	dne
resolute	dne

mariadb-10.3

focal	needs-triage
jammy	dne
noble	dne
questing	dne
resolute	dne

mariadb-10.6

jammy	needs-triage
noble	dne
questing	dne
resolute	dne

openSUSE / SLES Releases

openSUSE Product

Release

libmariadbd-devel

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

libmariadbd19

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb-client

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb-errormessages

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb-tools

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

Common Weakness Enumeration

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References

https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw

https://jira.mariadb.org/browse/MDEV-39721

https://access.redhat.com/errata/RHSA-2026:25143

https://access.redhat.com/errata/RHSA-2026:25145

https://access.redhat.com/errata/RHSA-2026:33093

https://access.redhat.com/errata/RHSA-2026:33412

https://access.redhat.com/errata/RHSA-2026:33464

https://access.redhat.com/errata/RHSA-2026:33481

https://access.redhat.com/errata/RHSA-2026:33482

https://access.redhat.com/security/cve/CVE-2026-49261

https://bugzilla.redhat.com/show_bug.cgi?id=2487957

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json