A security flaw has been found in MariaDB, a community-developed fork of the popular MySQL database system that many websites rely on to store content, user information, and other site data. The issue affects specific MariaDB versions from 10.6.1 to 10.6.26, 10.11.1 to 10.11.17, 11.4.1 to 11.4.11, 11.8.1 to 11.8.7, and 12.3.1, but only when the wsrep_notify_cmd setting is turned on. If this setting is active, an attacker could run unauthorized commands on the database server simply by using a specially crafted name for a new server joining the database cluster, with malicious commands embedded directly in that name. Patches that fix this vulnerability are already available for all affected version lines: 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. For users who cannot apply the update immediately, the available temporary workaround is to disable the wsrep_notify_cmd setting.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
