CVE-2026-49261 is an OS command injection vulnerability in MariaDB server's wsrep_notify_cmd feature. When enabled, a remote attacker can embed shell commands in the name of a joiner node to execute arbitrary code on the server, potentially gaining full control. Exploitation requires the wsrep_notify_cmd server variable to be set to a notification script (disabled by default) and acceptance of the attacker's node into the Galera cluster membership. Red Hat has issued a security advisory with updated MariaDB 10.11 RPMs (version 10.11.18-1.hum1) for Red Hat Hardened Images to fix this issue. The vulnerability is tracked under CWE-78 (OS Command Injection), CWE-266, and CWE-22.

Successful exploitation allows remote attackers to execute arbitrary operating system commands with the privileges of the MariaDB server process, leading to full system compromise. This can result in unauthorized code execution, data modification, data disclosure, denial of service, and hiding of malicious activities. The attack complexity is high, requiring specific configuration and cluster membership. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Red Hat has released updated MariaDB 10.11 RPM packages (version 10.11.18-1.hum1) as part of the Red Hat Hardened Images update to fix this vulnerability. Users should apply this update promptly. Additionally, the wsrep_notify_cmd feature is disabled by default; administrators should ensure it remains disabled unless explicitly required. Restrict cluster membership to trusted nodes to prevent unauthorized joiners. No other mitigations are specified by Red Hat.