CVE-2026-49261: Critical Command Injection in MariaDB

CVE-2026-49261 is a critical (CVSS 10.0) command injection in MariaDB Server. When wsrep_notify_cmd is enabled, the server runs shell commands embedded in the name of a joining Galera node. Upgrade to 10.6.27, 10.11.18, 11.4.12, 11.8.8 or 12.3.2, or disable wsrep_notify_cmd until you can.

What's affected

Per the MariaDB security advisory GHSA-3p3m-4x7c-p4pw, only servers with wsrep_notify_cmd enabled are affected.

• Weakness: CWE-78, OS command injection.
• CVSS 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
• Published 11 June 2026. Not marked as exploited in CISA KEV.
• Red Hat has published errata for the same CVE, so check your distribution's own package advisories too.

How to check if you're exposed

Check the server version, then check whether the notify command is set.

SELECT VERSION();
SHOW VARIABLES LIKE 'wsrep_notify_cmd';

An empty value for wsrep_notify_cmd means the feature is off. You can also look in your option files, usually under /etc/mysql/ or /etc/my.cnf.d/, for a wsrep_notify_cmd line.

On packaged installs, ask the package manager too:

mariadbd --version
rpm -q MariaDB-server    # RPM based systems
dpkg -l | grep -i mariadb-server   # Debian based systems

If you run containers, check the image tag. Distribution packages may carry backported fixes without changing the upstream version number, so read your vendor's advisory before deciding.

What to do now

1. Upgrade MariaDB Server to the fixed release for your branch: 10.6.27, 10.11.18, 11.4.12, 11.8.8 or 12.3.2, or a distribution package that your vendor says includes the fix.
2. If you cannot upgrade today, disable wsrep_notify_cmd, as the advisory advises as a workaround. Restart or reconfigure as your cluster procedure requires.
3. Review who can join a Galera cluster. Restrict the cluster ports to the nodes that belong there and use cluster authentication and network encryption.
4. Check that node names in your cluster are what you expect.
5. Review any scripts that wsrep_notify_cmd points to, and keep them minimal.
6. Re-scan your images and hosts afterwards to confirm the new version is the one that is running.

Why it matters

The notify command is a hook. MariaDB calls an administrator-supplied script when the cluster state changes and passes it details such as node names. The advisory says the server ran shell commands that were embedded in a joiner node's name. That is CWE-78: data from the network ended up in a shell command.

The score of 10.0 reflects the combination of network reach, no login and a changed scope. That said, the problem only exists where the notify hook is enabled, which is a clear and checkable condition. If you do not use it, turn it off and keep your attention on the upgrade.

Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs. Reachability analysis helps with libraries, but for a database server the quickest signal is the version and the configuration check above.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• MariaDB security advisory GHSA-3p3m-4x7c-p4pw
• MariaDB Jira MDEV-39721
• Red Hat errata RHSA-2026:25143
• Safeguard Gold entry

Last reviewed: 19 October 2026.