Logo
›
›vulnerability›CVE-2026-49261
Name
CVE-2026-49261
Source
NVD ( link)Debian ( link)
Description
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
CWEs
CWE-78
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pwVendor Advisory
https://jira.mariadb.org/browse/MDEV-39721Issue Tracking

Analysis#

Affected Component
Analysis
mariadb
Exploitable

Vulnerability Ratings#

10
CVSSv31
9.8
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
mariadb
buildroot
master
10.11.17
Exploitable
libmariadb
openwrt
master
3.4.8-r3
Not Affected
mariadb
openwrt
master
11.8.3-r1
Exploitable
libmariadb
openwrt
openwrt-25.12
3.4.8-r3
Not Affected
mariadb
openwrt
openwrt-25.12
11.8.3-r1
Exploitable
mariadb
yocto
kirkstone
10.7.8
Not Affected
mariadb
yocto
master
11.4.12
Not Affected
mariadb
yocto
scarthgap
10.11.16
Exploitable