CVE-2026-49261 is an arbitrary code execution vulnerability in MariaDB server's wsrep_notify_cmd feature. If enabled, an attacker who can join the Galera cluster can inject shell commands via the joiner node's name, leading to full system compromise. The vulnerability is rated Important by Red Hat, with a high CVSS impact on confidentiality, integrity, and availability. The default configuration disables this feature (wsrep_notify_cmd is empty and wsrep_on=0), reducing exposure. Red Hat has issued an update to MariaDB 11.8.8-1.hum1 RPMs in Hardened Images to fix this and related vulnerabilities.

Successful exploitation allows remote attackers to execute arbitrary operating system commands with the privileges of the MariaDB server process, potentially leading to full system compromise, data modification, denial of service, and unauthorized data access. The vulnerability requires specific configuration (wsrep_notify_cmd enabled) and cluster membership, limiting exposure. The default Red Hat configuration mitigates risk by disabling this feature.

Red Hat has released updated MariaDB RPM packages (version 11.8.8-1.hum1) that fix this vulnerability. Users should apply these updates promptly. Additionally, ensure that the wsrep_notify_cmd server variable remains unset or empty unless explicitly required and understood. Since the default configuration disables wsrep_notify_cmd and Galera clustering (wsrep_on=0), no further action is required if these defaults are maintained.