CVE-2026-49261 is an OS command injection vulnerability (CWE-78) in MariaDB server related to the wsrep_notify_cmd feature. When enabled, the server executes shell commands embedded in the name of the joiner node, allowing an attacker to execute arbitrary code with the privileges of the MariaDB server process. The vulnerability affects multiple version ranges: 10.6.1 to 10.6.26, 10.11.1 to 10.11.17, 11.4.1 to 11.4.11, 11.8.1 to 11.8.7, and version 12.3.1. Official fixes are available in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. Red Hat has issued advisories and updates rebasing MariaDB 10.11 to 10.11.18 to address this and other issues. The vulnerability is rated critical with a CVSS 3.1 base score of 10.0, reflecting network attack vector, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact.

Successful exploitation allows an unauthenticated attacker to execute arbitrary OS commands on the MariaDB server with the privileges of the database server process. This can lead to full system compromise, including complete confidentiality, integrity, and availability loss of the affected system. The vulnerability is critical and can be exploited remotely without authentication or user interaction.

An official fix is available in MariaDB server versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. Users are strongly advised to upgrade to these fixed versions. For those unable to upgrade immediately, disabling the wsrep_notify_cmd feature serves as a temporary workaround to prevent exploitation. Red Hat has released updated packages rebasing MariaDB 10.11 to 10.11.18 that include the fix. Refer to the Red Hat advisories and MariaDB release notes for detailed upgrade instructions.