CVE-2026-49261·MariaDB vulnerability
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
- Severity
- critical
- Software
- MariaDB
- Fixed in
- 11.8.8
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.60% — higher than 44% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Read the two together. CVE-2026-49261 scores 10 on CVSS, so a successful attack would be serious — but at 0.60%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.
Affected versions
From: 11.8.1
Until: 11.8.8
Fixed in: 11.8.8
How to fix this CVE
MariaDB versions 11.8.1 through 11.8.7 contain a critical command injection vulnerability in the wsrep_notify_cmd parameter that allows unauthenticated remote code execution when Galera clustering is enabled. Upgrade to MariaDB 11.8.8 or later immediately. As a temporary mitigation, disable the wsrep_notify_cmd configuration option if you cannot upgrade immediately.
sudo dnf update mariadb-serverDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
Cluster join notifications containing shell metacharacters (e.g., backticks, $(), pipes, redirects) in the wsrep_notify_cmd callback logs; error messages indicating command execution failures or unexpected process spawning in MariaDB error logs at the time a node joins the cluster.How to check if you are affected
- Check installed MariaDB version: mysql --version or SELECT @@version;
- Verify if wsrep_notify_cmd is configured: mysql -e "SHOW VARIABLES LIKE 'wsrep_notify_cmd';"
- Check if Galera clustering is active: mysql -e "SHOW VARIABLES LIKE 'wsrep_on';" — if value is ON, wsrep features are enabled
- Confirm patch applied: mysql -e "SELECT @@version;" should show 11.8.8 or later
FAQ
What is CVE-2026-49261?
CVE-2026-49261 is a critical remote code execution vulnerability in MariaDB's Galera replication feature where attacker-controlled node names can inject arbitrary shell commands through the wsrep_notify_cmd parameter, executing with the privileges of the MariaDB process.
Is CVE-2026-49261 being actively exploited?
No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available, but the critical CVSS 10.0 score makes it a high-priority patch.
What versions of MariaDB are affected by CVE-2026-49261?
Affected versions include 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1. For the 11.8 branch specifically, versions 11.8.1 through 11.8.7 are vulnerable.
How do I check if my server is vulnerable to CVE-2026-49261?
Run: mysql -e "SELECT @@version, @@wsrep_on, @@wsrep_notify_cmd;" — if version is 11.8.1–11.8.7, wsrep_on is ON, and wsrep_notify_cmd is not empty, your server is vulnerable.
Does Defensia detect CVE-2026-49261?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-49261 will appear in your dashboard with remediation steps.
Related MariaDB CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-49261. Free for 1 server.
Get started free