The advisory covers a set of security fixes and enhancements for Red Hat Hardened Images RPMs, specifically MariaDB server version 11.8.8-1.hum1 and related packages. A notable vulnerability (CVE-2026-49261) involves an OS command injection via the wsrep_notify_cmd feature, which if enabled, allows a remote attacker to execute arbitrary code by embedding shell commands in the name of a joiner node in a Galera cluster. Exploitation requires the wsrep_notify_cmd variable to be explicitly set by the administrator (it is empty by default), and the attacker must successfully join a malicious node to the cluster. The advisory lists multiple CVEs and CWE identifiers related to command injection, improper access control, path traversal, and resource exhaustion. Red Hat provides updated RPMs to fix these vulnerabilities.

If exploited, CVE-2026-49261 allows remote attackers to execute arbitrary operating system commands on the MariaDB server, potentially leading to full system compromise. Other vulnerabilities in the update may allow unauthorized access, denial of service, or data modification. However, exploitation of CVE-2026-49261 requires specific configuration (wsrep_notify_cmd enabled) and attacker capability to join the cluster, limiting the attack surface. The overall impact is high due to the possibility of remote code execution and full control over the affected system.

Red Hat has released fixed RPM packages (version 11.8.8-1.hum1) for MariaDB and related components in Red Hat Hardened Images. Administrators should apply these updates promptly to remediate the vulnerabilities. The wsrep_notify_cmd variable is disabled by default, and Red Hat's Galera configuration disables wsrep_on by default, reducing exposure. If the feature is not required, ensure it remains disabled. Follow Red Hat's official advisory and update instructions at https://access.redhat.com/errata/RHSA-2026:25143 for detailed remediation steps.