A security flaw has been identified in certain versions of MariaDB, a widely used open-source database software that powers many websites. If you run an affected version of MariaDB with the wsrep_notify_cmd setting turned on, an attacker could hide malicious system commands in the name of a new server that joins your database cluster, and those commands would run automatically on your hosting account.
The impacted MariaDB versions are 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1. Patched versions that resolve this issue are now available for each of these version lines: 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
If you cannot upgrade your MariaDB installation right away, you can eliminate this risk by disabling the wsrep_notify_cmd setting in your database configuration.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
