CRITICALVulnerability
CVE-2026-49261
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
Properties
- severity
- CRITICAL
- score
- 10
- cve_id
- CVE-2026-49261
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- published_at
- 2026-06-11T18:16:26.553
- last_modified
- 2026-08-11T13:18:57.810
Related Entities (4)
AFFECTS_PRODUCT (2)
→[Product]
→[Product]
HAS_WEAKNESS (1)
→[Weakness]Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph