CVE-2026-49261

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
MariaDB	server	>= 10.6.1, < 10.6.27; >= 10.11.1, < 10.11.18; >= 11.4.1, < 11.4.12; >= 11.8.1, < 11.8.8; = 12.3.1
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 9	—

References

Timeline

Published: Jun 11, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-492623.0In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Serv CVE-2026-492632.0Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM inst CVE-2026-492646.1OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in o CVE-2026-492656.8OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib CVE-2026-492675.9Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the CVE-2026-492689.1A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied CVE-2026-492698.6Apple M1 GPUs retain register file data between compute shader dispatches from different processes. A sandboxed Metal attacker app can run a CVE-2026-49276.5Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain othe CVE-2026-492705.9Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers t CVE-2026-492716.5libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef c CVE-2026-492728.5OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflo CVE-2026-492745.3Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the page