MariaDB is a popular open-source database tool that many websites use to store important information like user accounts, site content, and order records. A security flaw has been found in specific MariaDB versions: if a setting called `wsrep_notify_cmd` is turned on, the database will automatically run any hidden commands that are embedded in the name of a new server joining a database cluster. This could allow an attacker to run unauthorized actions on your server if they are able to control the name of a server added to your MariaDB cluster.
The affected versions are 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1, but only when the `wsrep_notify_cmd` setting is enabled. If you do not use this setting, or are running a different MariaDB version, your system is not at risk from this issue.
The vulnerability is fixed in updated MariaDB releases: 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. If you cannot upgrade to one of these versions right away, you can temporarily turn off the `wsrep_notify_cmd` setting to block the flaw from being exploited.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
