A security vulnerability has been identified in MariaDB, a popular open-source database system used by many websites to store site content and user data. If you run MariaDB versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, or 12.3.1 with the wsrep_notify_cmd setting enabled, malicious actors could run unauthorized commands on your server by embedding harmful instructions in the name of a node that joins your database cluster.
The flaw is already resolved in updated MariaDB releases: 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. For users who cannot upgrade to one of these versions immediately, the risk can be eliminated by disabling the wsrep_notify_cmd setting as a temporary workaround.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
