A security flaw tracked as CVE-2026-49261 has been found in MariaDB, a popular open-source database tool that many websites use to store user information, content, and other important data. If you run an affected version of MariaDB (10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, or 12.3.1) and have the `wsrep_notify_cmd` feature turned on, an attacker could run unauthorized commands on your server by hiding malicious code in the name of a new node that connects to your database. This could allow bad actors to access, modify, or delete your website's data, or even take control of your hosting environment.
This issue has been patched in newer MariaDB releases: 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. If you are unable to upgrade your MariaDB version right now, you can avoid the risk by disabling the `wsrep_notify_cmd` setting.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-49261
