Read the docs
TI-2026-36456 Aliases CVE-2026-49261

MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

Priority MEDIUM 52CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.

Summary

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01582 75th percentileScored 2026-11-07
Fix Fixed server (MariaDB): 10.6.27, 10.11.18, 11.4.12 +1Red Hat: 10 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MariaDBserver10.6.1 to before 10.6.27; 10.11.1 to before 10.11.18; 11.4.1 to before 11.4.12; 11.8.1 to before 11.8.8; = 12.3.110.6.27, 10.11.18, 11.4.12, 11.8.8Patch availableCNA
  • server VendorMariaDB Affected 10.6.1 to before 10.6.27; 10.11.1 to before 10.11.18; 11.4.1 to before 11.4.12; 11.8.1 to before 11.8.8; = 12.3.1 Fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*10.6.1 to before 10.6.27; 10.11.1 to before 10.11.18; 11.4.1 to before 11.4.12; 11.8.1 to before 11.8.8VulnerableMariaDB
cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*12.3.1VulnerableMariaDB
  • cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* Versions 10.6.1 to before 10.6.27; 10.11.1 to before 10.11.18; 11.4.1 to before 11.4.12; 11.8.1 to before 11.8.8 Vulnerable ·MariaDB
  • cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:* Versions 12.3.1 Vulnerable ·MariaDB

Remediation

  • Fix · CNA server (MariaDB) Fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8

Red Hat 10 advisories

  • RHSA-2026:54142 Released 2026-08-12 · Red Hat rating Important
    mariadb:10.11 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) galera-26.4.20-1.module+el9.5.0+22578+dc54e53f.aarch64::mariadb:10.11, galera-26.4.20-1.module+el9.5.0+22578+dc54e53f.ppc64le::mariadb:10.11, galera-26.4.20-1.module+el9.5.0+22578+dc54e53f.s390x::mariadb:10.11 +47
  • RHSA-2026:52848 Released 2026-08-10 · Red Hat rating Important
    mariadb:10.11 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) galera-26.4.16-1.module+el9.4.0+21205+b026b850.aarch64::mariadb:10.11, galera-26.4.16-1.module+el9.4.0+21205+b026b850.ppc64le::mariadb:10.11, galera-26.4.16-1.module+el9.4.0+21205+b026b850.s390x::mariadb:10.11 +47
  • RHSA-2026:49522 Released 2026-08-03 · Red Hat rating Important
    mariadb10.11 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) mariadb-3:10.11.18-1.el10_0, mariadb-backup-3:10.11.18-1.el10_0, mariadb-client-utils-3:10.11.18-1.el10_0 +13
Show 7 more Red Hat advisories
  • RHSA-2026:33482 Released 2026-06-30 · Red Hat rating Important
    mariadb:10.11 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) galera-26.4.27-1.module+el9.8.0+24388+85f1c439.aarch64::mariadb:10.11, galera-26.4.27-1.module+el9.8.0+24388+85f1c439.ppc64le::mariadb:10.11, galera-26.4.27-1.module+el9.8.0+24388+85f1c439.s390x::mariadb:10.11 +47
  • RHSA-2026:33481 Released 2026-06-30 · Red Hat rating Important
    mariadb:11.8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) galera-26.4.27-1.module+el9.8.0+24389+c97c30be.aarch64::mariadb:11.8, galera-26.4.27-1.module+el9.8.0+24389+c97c30be.ppc64le::mariadb:11.8, galera-26.4.27-1.module+el9.8.0+24389+c97c30be.s390x::mariadb:11.8 +47
  • RHSA-2026:33464 Released 2026-06-30 · Red Hat rating Important
    mariadb:10.11 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) Judy-1.0.5-18.module+el8.10.0+21221+7bee72c1.aarch64::mariadb:10.11, Judy-1.0.5-18.module+el8.10.0+21221+7bee72c1.ppc64le::mariadb:10.11, Judy-1.0.5-18.module+el8.10.0+21221+7bee72c1.s390x::mariadb:10.11 +47
  • RHSA-2026:33412 Released 2026-06-30 · Red Hat rating Important
    galera and mariadb11.8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) mariadb11.8-3:11.8.8-1.el10_2, mariadb11.8-backup-3:11.8.8-1.el10_2, mariadb11.8-client-utils-3:11.8.8-1.el10_2 +12
  • RHSA-2026:33093 Released 2026-06-29 · Red Hat rating Important
    mariadb10.11 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) mariadb-3:10.11.18-1.el10_2, mariadb-backup-3:10.11.18-1.el10_2, mariadb-client-utils-3:10.11.18-1.el10_2 +13
  • RHSA-2026:25145 Released 2026-06-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images mariadb10.11-10.11.18-1.hum1@aarch64, mariadb10.11-10.11.18-1.hum1@src, mariadb10.11-10.11.18-1.hum1@x86_64 +37
  • RHSA-2026:25143 Released 2026-06-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images mariadb-11.8.8-1.hum1@aarch64, mariadb-11.8.8-1.hum1@x86_64, mariadb-backup-11.8.8-1.hum1@aarch64 +37

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:33093, RHSA-2026:33412
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:33464
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:33481, RHSA-2026:33482
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:52848
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:49522
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:54142
Red Hat Hardened ImagesFixed RHSA-2026:25143, RHSA-2026:25145
Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 10)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49261

References

Advisory 1

Other 1

  • TI-2023-11776 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
  • TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
  • TI-2014-00217 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly… CVSS 3.1HIGH 7.4
  • TI-2014-00188 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0… CVSS 2.0MEDIUM 6.8
  • TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
See all 429 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences