10.0
Critical
CVE-2026-49261 MariaDB server is a community developed fork of MySQL server
Description
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| server | 12.3.1 | No fix stated |
| server 11.8 | 11.8.1 → < 11.8.8 | 11.8.8 |
| server 11.4 | 11.4.1 → < 11.4.12 | 11.4.12 |
| server 10.11 | 10.11.1 → < 10.11.18 | 10.11.18 |
| server 10.6 | 10.6.1 → < 10.6.27 | 10.6.27 |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Hardened Images 10.11 | earliest → < 10.11.18-1.hum1 | 10.11.18-1.hum1 |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 8 8100020260616102001.489197 | earliest → < 8100020260616102001.489197e6 | 8100020260616102001.489197e6 |
Show the 6 other branches Hide the 6 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 9040020260804103423 | earliest → < 9040020260804103423.rhel9 | 9040020260804103423.rhel9 |
References
- github.com github.com
- jira.mariadb.org jira.mariadb.org
Timeline
- Published
- Last modified
Other CVEs of server
The 27 CVEs of server →
CVE-2026-102523
MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
8.0
High
CVE-2026-86047
MariaDB server is a community developed fork of MySQL server
7.7
High
CVE-2026-85745
MariaDB server is a community developed fork of MySQL server
4.3
Medium
CVE-2026-85748
MariaDB server is a community developed fork of MySQL server
9.9
Critical