critical CVSS 10

CVE-2026-49261·MariaDB vulnerability

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

Severity
critical
Software
MariaDB
Fixed in
11.8.8
Published
2026-06-11

Affected versions

From: 11.8.1

Until: 11.8.8

Fixed in: 11.8.8

How to fix this CVE

MariaDB versions 11.8.1 through 11.8.7 contain a critical command injection vulnerability in the wsrep_notify_cmd parameter that allows unauthenticated remote code execution when Galera clustering is enabled. Upgrade to MariaDB 11.8.8 or later immediately. As a temporary mitigation, disable the wsrep_notify_cmd configuration option if you cannot upgrade immediately.

sudo dnf update mariadb-server

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

Cluster join notifications containing shell metacharacters (e.g., backticks, $(), pipes, redirects) in the wsrep_notify_cmd callback logs; error messages indicating command execution failures or unexpected process spawning in MariaDB error logs at the time a node joins the cluster.

How to check if you are affected

  1. Check installed MariaDB version: mysql --version or SELECT @@version;
  2. Verify if wsrep_notify_cmd is configured: mysql -e "SHOW VARIABLES LIKE 'wsrep_notify_cmd';"
  3. Check if Galera clustering is active: mysql -e "SHOW VARIABLES LIKE 'wsrep_on';" — if value is ON, wsrep features are enabled
  4. Confirm patch applied: mysql -e "SELECT @@version;" should show 11.8.8 or later

FAQ

What is CVE-2026-49261?

CVE-2026-49261 is a critical remote code execution vulnerability in MariaDB's Galera replication feature where attacker-controlled node names can inject arbitrary shell commands through the wsrep_notify_cmd parameter, executing with the privileges of the MariaDB process.

Is CVE-2026-49261 being actively exploited?

No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available, but the critical CVSS 10.0 score makes it a high-priority patch.

What versions of MariaDB are affected by CVE-2026-49261?

Affected versions include 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1. For the 11.8 branch specifically, versions 11.8.1 through 11.8.7 are vulnerable.

How do I check if my server is vulnerable to CVE-2026-49261?

Run: mysql -e "SELECT @@version, @@wsrep_on, @@wsrep_notify_cmd;" — if version is 11.8.1–11.8.7, wsrep_on is ON, and wsrep_notify_cmd is not empty, your server is vulnerable.

Does Defensia detect CVE-2026-49261?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-49261 will appear in your dashboard with remediation steps.

Related MariaDB CVEs

CVE-2026-44170CVSS 9.8MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-49261. Free for 1 server.

Get started free