A security flaw has been identified in MariaDB, a popular open-source database that many websites use to store content, user information, and other site data. If you are running one of the affected MariaDB versions (10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, or 12.3.1) and have the `wsrep_notify_cmd` setting enabled, malicious commands hidden in the name of a new node joining your database cluster could be run on your server. This could let unauthorized people access, modify, or delete your site's data, or cause your website to stop working as expected.
This issue is fixed in newer MariaDB releases: 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. If you cannot upgrade to one of these patched versions right now, you can avoid the risk by turning off the `wsrep_notify_cmd` setting in your MariaDB configuration.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
