MariaDB server versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1 contain an OS command injection vulnerability (CWE-78) in the SST process using the rsync method. During SST, the donor node interpolates parameters received from the joiner node into shell commands without proper validation, allowing a malicious joiner to execute arbitrary shell commands on the donor server. This can lead to full system compromise including unauthorized code execution, data modification, and denial of service. The vulnerability has been addressed by MariaDB in the specified fixed versions. Red Hat has issued advisories and security updates for affected products, recommending upgrading to fixed versions.

Successful exploitation allows a malicious joiner node to execute arbitrary shell commands on the donor node during the SST process, potentially leading to full system compromise. This includes unauthorized code execution, data disclosure, data modification, and denial of service. The vulnerability affects confidentiality, integrity, and availability of the MariaDB server and underlying system. Exploitation requires network access and high privileges on the joiner node but no user interaction. The scope of impact is changed as the vulnerability crosses component boundaries.

A fix is available and has been released in MariaDB server versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. Users should upgrade affected MariaDB server instances to these or later versions to remediate the vulnerability. Red Hat has released security updates for affected Red Hat Enterprise Linux 10 packages (mariadb10.11-10.11.18) that include the fix. Applying these vendor-provided updates is the recommended remediation. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed by vendor advisories.