CVE-2026-44168: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MariaDB server
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
AI Analysis
Technical Summary
MariaDB server versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1 contain an OS command injection vulnerability (CWE-78) in the SST process using the mariabackup method. During SST, the donor node interpolates parameters received from the joiner node into command lines without proper validation, enabling a malicious joiner to execute arbitrary shell commands on the donor side. This issue has been addressed with patches in the specified fixed versions. Red Hat advisories confirm the availability of updates that remediate this vulnerability.
Potential Impact
Successful exploitation allows a malicious joiner node to execute arbitrary shell commands on the donor node during the SST process, potentially leading to full compromise of the donor system. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available and has been released in MariaDB server versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2. Users should upgrade affected MariaDB server instances to these or later versions to remediate the vulnerability. Refer to the Red Hat advisories for detailed update instructions. No alternative mitigations or workarounds are specified in the vendor advisory.
CVE-2026-44168: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MariaDB server
Description
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVSS v3.1
Score 8.0high
Affected software
pkg:github/mariadb/serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
MariaDB server versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1 contain an OS command injection vulnerability (CWE-78) in the SST process using the mariabackup method. During SST, the donor node interpolates parameters received from the joiner node into command lines without proper validation, enabling a malicious joiner to execute arbitrary shell commands on the donor side. This issue has been addressed with patches in the specified fixed versions. Red Hat advisories confirm the availability of updates that remediate this vulnerability.
Potential Impact
Successful exploitation allows a malicious joiner node to execute arbitrary shell commands on the donor node during the SST process, potentially leading to full compromise of the donor system. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available and has been released in MariaDB server versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2. Users should upgrade affected MariaDB server instances to these or later versions to remediate the vulnerability. Refer to the Red Hat advisories for detailed update instructions. No alternative mitigations or workarounds are specified in the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-05T14:39:34.923Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-44168","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:25145","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:25143","vendor":"Red Hat"}]
Threat ID: 6a2c4809e617e2d8349cf149
Added to database: 06/12/2026, 17:55:21 UTC
Last enriched: 07/16/2026, 09:03:16 UTC
Last updated: 07/31/2026, 19:24:46 UTC
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.