CVE-2026-49261

CRITICAL EPSS 35.7%
Published Jun 11, 20262w ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Jun 11, 2026 2w ago
Last Modified Jun 17, 2026 2w ago

Description

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
35.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

Affected Products 5

VendorProductVersionRange
mariadbmariadb*≥10.6.1  –  <10.6.27
mariadbmariadb*≥10.11.1  –  <10.11.18
mariadbmariadb*≥11.4.1  –  <11.4.12
mariadbmariadb*≥11.8.1  –  <11.8.8
mariadbmariadb12.3.1any

References 2

  • github.com https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw
    Vendor Advisory
  • jira.mariadb.org https://jira.mariadb.org/browse/MDEV-39721
    Issue Tracking

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.