MariaDB is a popular open-source database used to store data for many websites, and a security flaw has been found in specific versions of the software. When a feature called wsrep_notify_cmd is enabled, the system will automatically run any shell commands hidden in the name of a node that joins your database cluster. This could allow an unauthorized person to run unwanted commands on your server if they are able to control that joiner node’s name.
The impacted MariaDB versions are 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1, but only if the wsrep_notify_cmd feature is turned on. If you run an affected version of MariaDB with this feature active, your account could be at risk of unauthorized command execution.
Patched versions that resolve this issue are 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. If you are unable to upgrade your MariaDB version right away, you can disable the wsrep_notify_cmd setting as a temporary workaround to eliminate the risk.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
