10.0 CriticalCWE-78
CVE-2026-49261
MariaDB server vulnerability
MariaDBserver
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 23 Oct
1.7%probability of exploitation in the next 30 days
Higher than 77% of scored CVEs
SeverityCVSS
10.0Critical
Description NVD
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
Coverage 2 articles · 1 outlet
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Sun 7 Jun · 21:50 UTC | SecurityOnline | CVE-2026-49261 flaw in MariaDB lets attackers run remote code |
| Tue 23 Jun · 02:31 UTC | SecurityOnline | Critical MariaDB bugs let attackers run shell commands via Galera |
- Critical MariaDB bugs let attackers run shell commands via GaleraSecurityOnline · mentions it in passing
- CVE-2026-49261 flaw in MariaDB lets attackers run remote codeSecurityOnline · first in our coverage