MariaDB server versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1 contain an OS command injection vulnerability (CWE-78) during the State Snapshot Transfer (SST) process used in clustering. The donor node interpolates parameters sent by the joiner node into shell commands without proper validation, allowing a malicious joiner with high privileges to execute arbitrary shell commands on the donor node. This vulnerability requires high privileges and high attack complexity but can lead to full compromise of the donor system. The issue has been patched in later versions as specified by the vendor. Red Hat has issued advisories and updates for affected products, providing official fixes.

Successful exploitation allows a malicious joiner node in a MariaDB cluster to execute arbitrary operating system commands on the donor node during SST. This can lead to complete compromise of the donor system, including unauthorized code execution, data modification, data disclosure, and denial of service. The vulnerability requires high privileges and high attack complexity, and no user interaction is needed. The scope of impact includes confidentiality, integrity, and availability of the affected system.

Official patches are available and should be applied to affected MariaDB server versions. The vulnerability is fixed in MariaDB versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2. Users should upgrade to these or later versions to remediate the issue. Red Hat has released security advisories and updated packages for their supported distributions; applying these updates is recommended. No alternative mitigations are specified by the vendor advisory. Patch status is confirmed by the vendor advisory.