CVE-2026-49261
CRITICAL WAF: High
CVSS 9.8
Published: 2026-06-11
CWE-78 CWE-78
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
WAF Coverage Analysis
OS Command Injection
High WAF Coverage
OWASP: A03:2021 Injection
932xxx - Remote Code Execution
OS Command Injection
High WAF Coverage
OWASP: A03:2021 Injection
932xxx - Remote Code Execution
Affected Software
| Vendor | Product | Version |
|---|---|---|
| mariadb | mariadb | 10.6.1 - 10.6.27 |
| mariadb | mariadb | 10.11.1 - 10.11.18 |
| mariadb | mariadb | 11.4.1 - 11.4.12 |
| mariadb | mariadb | 11.8.1 - 11.8.8 |
| mariadb | mariadb | 12.3.1 |