A security vulnerability tracked as CVE-2026-49261 has been identified in MariaDB, a widely used open-source database system that many websites rely on to store content, user data, and other critical site information. The flaw affects specific MariaDB versions when a setting called `wsrep_notify_cmd` is enabled: 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and version 12.3.1.
If your site runs one of these affected versions with that setting turned on, an attacker could execute unauthorized commands on your server by using a specially crafted name for a node that joins your database cluster. This could allow bad actors to access, modify, or delete your site’s data, or gain unauthorized control over parts of your hosting environment.
The issue has been fully patched in newer MariaDB versions: 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. If you are currently unable to upgrade your MariaDB version, you can disable the `wsrep_notify_cmd` setting as a temporary workaround to eliminate the associated risk.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
