CVE-2026-49261MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`
Updated under an hour ago ()
Does this affect you?
It affects MariaDB server and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
- CVSS
- 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-78
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Modified
- Record last updated
- Aug 12, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
MariaDB server mariadb:server (from the name) | from 10.6.1, < 10.6.27; from 10.11.1, < 10.11.18; from 11.4.1, < 11.4.12; from 11.8.1, < 11.8.8; = 12.3.1 | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 3:10.11.18-1.el10_2 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 3:10.11.18-1.el10_0 not affected | CISA ADP |
from 9040020260804103423.rhel9 not affected | CISA ADP | |
Red Hat Red Hat Hardened Images redhat:hummingbird | from 11.8.8-1.hum1 not affected | CISA ADP |
mariadb mariadb mariadb:mariadb | from 10.6.1 before 10.6.27; from 10.11.1 before 10.11.18; from 11.4.1 before 11.4.12; from 11.8.1 before 11.8.8; 12.3.1 | NVD |
References
- https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pwx-refsource-confirm, vendor-advisory
- https://jira.mariadb.org/browse/MDEV-39721x-refsource-misc, issue-tracking
- https://access.redhat.com/errata/RHSA-2026:25143
- https://access.redhat.com/errata/RHSA-2026:25145
- https://access.redhat.com/errata/RHSA-2026:33093
- https://access.redhat.com/errata/RHSA-2026:33412
- https://access.redhat.com/errata/RHSA-2026:33464
- https://access.redhat.com/errata/RHSA-2026:33481
- https://access.redhat.com/errata/RHSA-2026:33482
- https://access.redhat.com/errata/RHSA-2026:49522
- https://access.redhat.com/errata/RHSA-2026:52848
- https://access.redhat.com/errata/RHSA-2026:54142
- https://access.redhat.com/security/cve/CVE-2026-49261
- https://bugzilla.redhat.com/show_bug.cgi?id=2487957
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.