A security flaw has been identified in MariaDB, a common open-source database tool many websites use to store user data, content, and other site information. The issue only impacts specific MariaDB versions when the `wsrep_notify_cmd` setting is enabled: if a new server joins a group of connected MariaDB servers (known as a cluster), the server will run any shell commands hidden inside that new server’s name. This could allow an unauthorized user to execute harmful commands on your server, putting your site and stored data at risk.
The affected versions are 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1, but only if you have the `wsrep_notify_cmd` setting turned on. If you run one of these versions with this setting active, your site could be vulnerable to this unauthorized command execution risk.
This flaw has been fixed in updated MariaDB releases: 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. If you cannot upgrade to one of these patched versions right away, you can disable the `wsrep_notify_cmd` setting as a temporary workaround to avoid the vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
