high CVSS 8

CVE-2026-44168·MariaDB vulnerability

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Severity
high
Software
MariaDB
Fixed in
11.8.7
Published
2026-06-12

Affected versions

From: 11.8.1

Until: 11.8.7

Fixed in: 11.8.7

How to fix this CVE

MariaDB versions 11.8.1 through 11.8.6 contain a critical vulnerability in the SST (State Snapshot Transfer) mechanism where parameter validation is insufficient, allowing malicious cluster nodes to execute arbitrary shell commands on the donor node. Upgrade to MariaDB 11.8.7 or later immediately, particularly if your deployment uses mariabackup for cluster replication. After patching, restart the MariaDB service and verify cluster synchronization.

sudo dnf update mariadb-server

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check installed MariaDB version by running `mariadb --version` or connecting to the database and executing `SELECT VERSION();`
  2. Step 2: Verify if SST/mariabackup is configured in `/etc/mysql/conf.d/` or `/etc/my.cnf.d/` by searching for `wsrep_sst_method` configuration parameter
  3. Step 3: Review MariaDB error logs at `/var/log/mysql/error.log` or `/var/log/mariadb/mariadb.log` for suspicious SST donor/joiner communications or shell command injection attempts
  4. Step 4: After upgrading, confirm the new version is active with `mariadb --version` and restart the service with `sudo systemctl restart mariadb`, then check cluster status with `SHOW STATUS LIKE 'wsrep%';`

FAQ

What is CVE-2026-44168?

CVE-2026-44168 is a command injection vulnerability in MariaDB's SST (State Snapshot Transfer) mechanism where insufficient parameter validation in the mariabackup method allows a malicious cluster node to inject and execute arbitrary shell commands on the donor node with database privileges.

Is CVE-2026-44168 being actively exploited?

No, this vulnerability is not listed on the CISA KEV catalog and no public exploits are currently available, but the high CVSS score (8.0) warrants prompt patching due to the severity of potential impact if exploited.

What versions of MariaDB are affected by CVE-2026-44168?

Affected versions include 10.6.1 to 10.6.25, 10.11.1 to 10.11.16, 11.4.1 to 11.4.10, 11.8.1 to 11.8.6, and 12.3.1. For the 11.8 branch specifically, versions 11.8.1 through 11.8.6 are vulnerable.

How do I check if my server is vulnerable to CVE-2026-44168?

Run `mariadb --version` and cross-reference against the affected version ranges. Additionally, check if `wsrep_sst_method=mariabackup` is configured in your MariaDB configuration files, as this indicates the vulnerable SST method is in use.

Does Defensia detect CVE-2026-44168?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-44168 will appear in your dashboard with remediation steps.

Related MariaDB CVEs

CVE-2026-49261CVSS 10MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
CVE-2026-44170CVSS 9.8MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVE-2026-22730CVSS 8.8A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.
CVE-2026-32710CVSS 8.5MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2.
CVE-2026-48163CVSS 8MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-44168. Free for 1 server.

Get started free