MariaDB server versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 are vulnerable to OS command injection via the wsrep_notify_cmd feature. When enabled, this feature executes shell commands embedded in the name of a joiner node in a Galera cluster, allowing a remote attacker who can join the cluster to execute arbitrary OS commands with the privileges of the MariaDB server process. The vulnerability is tracked as CWE-78 and has a CVSS v3.1 base score of 10.0, indicating critical severity with network attack vector, no privileges or user interaction required, and full confidentiality, integrity, and availability impact. Red Hat has assessed the vulnerability as Important for their products, noting that exploitation requires explicit enabling of wsrep_notify_cmd and acceptance of a malicious node into the cluster. Fixed versions are 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. The vendor advisory recommends upgrading to these fixed versions or disabling wsrep_notify_cmd as a workaround.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the MariaDB server with the privileges of the database process. This can lead to full system compromise, including unauthorized data access, modification, denial of service, and hiding of malicious activities. The vulnerability affects confidentiality, integrity, and availability of the affected system.

A fix is available in MariaDB versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. Users should upgrade to these versions to remediate the vulnerability. If immediate upgrade is not possible, the vendor advisory recommends disabling the wsrep_notify_cmd feature to mitigate the risk. Exploitation requires wsrep_notify_cmd to be explicitly enabled and acceptance of a malicious node into the cluster, so ensuring wsrep_notify_cmd is disabled by default reduces exposure.