CVE-2026-49261 is an arbitrary code execution vulnerability in MariaDB Server when the wsrep_notify_cmd feature is enabled. An attacker who can join a MariaDB/Galera cluster can inject shell commands via the joiner node's name, leading to execution of unauthorized OS commands on the server. Exploitation requires the wsrep_notify_cmd server variable to be set to a notification script by the administrator; it is empty by default upstream and disabled in Red Hat's Galera configuration. The vulnerability is tracked as CWE-78 (OS Command Injection). Red Hat has released a security update rebasing MariaDB 10.11 to 10.11.18 in Red Hat Enterprise Linux 10 to fix this issue.

Successful exploitation allows a remote attacker to execute arbitrary operating system commands on the affected MariaDB server, potentially leading to full system compromise. This can result in unauthorized code execution, data modification, denial of service, and other severe impacts. However, exploitation requires specific conditions: the wsrep_notify_cmd variable must be explicitly enabled and the attacker must be able to join the Galera cluster, limiting the attack surface.

A security update is available that fixes this vulnerability by rebasing MariaDB 10.11 to version 10.11.18 in Red Hat Enterprise Linux 10. Administrators should apply this update promptly. If the wsrep_notify_cmd feature is not required, ensure it remains unset or disabled (default setting) to mitigate risk. No additional mitigation is necessary if the feature is not enabled. Red Hat's advisory confirms the fix and recommends upgrading to the updated packages.