CVE Intelligence
Analysis AI-assisted

CVE-2026-49261: MariaDB Server OS command injection via wsrep_notify_cmd joiner name

MariaDB Server builds with wsrep_notify_cmd enabled can execute shell commands embedded in the name of a joiner node, according to the record. NVD rates it 9.8 (critical) and classifies it as CWE-78 OS Command Injection. Fixed releases are listed, and disabling wsrep_notify_cmd is the stated workaround.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-49261 affects the MariaDB server when the wsrep_notify_cmd option is enabled. According to the record, a joiner node name can carry embedded shell commands that the server then executes. The weakness is classified as CWE-78 (OS Command Injection).

Impact

  • The record describes execution of shell commands on the server host.
  • NVD scores the issue 9.8 (critical) with high confidentiality, integrity and availability impact. A GitHub entry in the record scores it 10.
  • SSVC data in the record marks exploitation as none, automatable as yes, and technical impact as total.

Affected products and versions

  • According to the description, the affected versions are from 10.6.1 up to and including 10.6.26, from 10.11.1 up to and including 10.11.17, from 11.4.1 up to and including 11.4.11, from 11.8.1 up to and including 11.8.7, and 12.3.1, when wsrep_notify_cmd is enabled.
  • The description states fixes in 10.6.27, 10.11.18, 11.4.12, 11.8.8 and 12.3.2.
  • The record lists two product entries (Mariadb Mariadb and MariaDB Server) with equivalent ranges.

Exploitation status

The CISA KEV catalog entry in the record is not listed, so no active exploitation is recorded there. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.01691 with a percentile of 0.7692.

Remediation and mitigation

  • Upgrade to the fixed release for your branch: 10.6.27, 10.11.18, 11.4.12, 11.8.8 or 12.3.2.
  • If an upgrade cannot happen right away, the stated workaround is to disable wsrep_notify_cmd.
  • Review the GitHub security advisory for vendor details.

Detection guidance

  • Check whether wsrep_notify_cmd is enabled in Galera cluster configurations.
  • Review node naming and joiner registration for unexpected or unusual characters.
  • Monitor for unexpected child processes started by the database server process.

Limitations of the available information

  • The record gives no detail beyond the description on the exact trigger conditions.
  • The fixes field in the record is empty, so the fixed versions come from the description and the affected ranges.
  • CVSS scores differ across providers in the record.
  • Whether a particular deployment is reachable by an attacker depends on details not present in the record.

Frequently asked questions

Is CVE-2026-49261 being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What is the workaround if I cannot upgrade?

The description states that disabling wsrep_notify_cmd is the workaround for anyone who cannot upgrade.

Which versions are fixed?

According to the description, fixes are in 10.6.27, 10.11.18, 11.4.12, 11.8.8 and 12.3.2.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.