This advisory covers a security update for Red Hat Hardened Images RPMs, specifically MariaDB 10.11 packages, addressing several vulnerabilities including CVE-2026-49261. The critical flaw in MariaDB server allows remote attackers to execute arbitrary OS commands by embedding shell commands in the name of a joiner node when the wsrep_notify_cmd feature is enabled. Exploitation requires the wsrep_notify_cmd variable to be explicitly set to a notification script (disabled by default) and acceptance of a malicious node into the Galera cluster. The update provides fixed RPM packages for multiple MariaDB components on aarch64 and x86_64 architectures. Red Hat rates this vulnerability as Important (high severity) and provides official patches.

Successful exploitation of CVE-2026-49261 can lead to arbitrary code execution on the affected MariaDB server, allowing attackers to gain full control over the system. This includes the ability to execute unauthorized OS commands, potentially leading to data modification, data disclosure, denial of service, or complete system compromise. The vulnerability requires specific configuration and attacker-controlled cluster membership, limiting its exploitability. Other addressed vulnerabilities in the update may also impact confidentiality, integrity, and availability.

Red Hat has released updated MariaDB 10.11 RPM packages that fix these vulnerabilities. Users should apply the provided updates to Red Hat Hardened Images and MariaDB packages as soon as possible. Since exploitation requires the wsrep_notify_cmd variable to be explicitly enabled and a malicious node to join the cluster, administrators should ensure this feature is disabled if not needed and carefully control cluster membership. Refer to the official Red Hat advisory RHSA-2026:25145 for detailed update instructions and apply the fixed RPM versions.