If your website uses MariaDB database software, there is a security issue that impacts specific versions when a feature called wsrep_notify_cmd is enabled. This flaw lets shell commands hidden in the name of a node that joins a MariaDB cluster run automatically on the server, which could be exploited by unauthorized users to take unwanted actions on your system.
The affected MariaDB versions are 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1. Successful exploitation could allow unauthorized commands to run on your database server, putting your website’s stored data, functionality, or overall security at risk.
Fixed versions are now available for all impacted release lines: 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. If you cannot upgrade to one of these versions right away, you can mitigate the risk by turning off the wsrep_notify_cmd feature.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
