MariaDB server versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 are vulnerable to an OS command injection during the SST process using the rsync method. The donor node interpolates parameters from the joiner without proper validation, enabling a malicious joiner to execute arbitrary shell commands on the donor node. This vulnerability is identified as CWE-78 and has a CVSS 3.1 base score of 8.0, indicating high severity with network attack vector, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Official patches are available in MariaDB versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. Red Hat advisories confirm the availability of fixes in their updated packages.

Successful exploitation allows a malicious joiner node during SST to execute arbitrary shell commands on the donor node, potentially leading to full compromise of the donor system. This impacts confidentiality, integrity, and availability of the affected MariaDB server instance. The vulnerability requires high privileges on the joiner node and network access to the donor node. There are no known exploits in the wild at this time.

A fix is available and has been released in MariaDB server versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. Users should upgrade to these or later versions to remediate this vulnerability. Red Hat provides updated packages for affected distributions and recommends applying these updates promptly. No additional mitigation steps are specified beyond applying the official patches.