A security flaw has been found in specific versions of MariaDB, a common open-source database tool that many websites use to store content, user information, and other important site data. The flaw impacts MariaDB versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1, but only when the `wsrep_notify_cmd` setting is turned on. When this setting is active, the MariaDB server will automatically run any shell commands hidden in the name of a new server added to your database cluster. This could let an unauthorized person run harmful commands on your server, which may lead to stolen data, lost site content, or other damage to your website. The issue is resolved in updated MariaDB versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. For users who are unable to upgrade to a fixed version right away, disabling the `wsrep_notify_cmd` setting will eliminate the risk from this flaw.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
