This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] MariaDB Server fixes 3 vulnerabilities

With versions 10.6.27, 10.11.18, 11.4.12, 11.8.8 and 12.3.2, MariaDB Server fixes 3 vulnerabilities, 1 of them critical [1].

MariaDB Server - shell command execution (CVE-2026-49261)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can execute arbitrary shell commands due to insufficient sanitization of the joining node name when wsrep_notify_cmd is enabled in MariaDB Server. Users who cannot update at this time should disable wsrep_notify_cmd [1].

The vulnerability is present in product:

  • MariaDB; >=10.6.1, <=10.6.26; >=10.11.1, <=10.11.17; >=11.4.1, <=11.4.11; >=11.8.1, <=11.8.7; =12.3.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2026-49261 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 2. 6. 2026.

MariaDB Server - shell command execution (CVE-2026-48165)
CVSS 8.0 (High)

An authenticated remote attacker with high privileges can execute shell commands with the privileges of the mariadbd process on the joining Galera node due to insufficient sanitization of the global system variables wsrep_sst_receive_address and wsrep_sst_donor [2].

The vulnerability is present in product:

  • MariaDB; >=10.6.1, <=10.6.26; >=10.11.1, <=10.11.17; >=11.4.1, <=11.4.11; >=11.8.1, <=11.8.7; =12.3.1

CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2026-48165 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 2. 6. 2026.

MariaDB Server - shell command execution (CVE-2026-48163)
CVSS 8.0 (High)

An authenticated remote attacker can execute arbitrary shell commands when the rsync SST method is used, due to insufficient validation of parameters passed during SST (State Snapshot Transfer) in MariaDB Galera Cluster [3].

The vulnerability is present in product:

  • MariaDB; >=10.6.1, <=10.6.26; >=10.11.1, <=10.11.17; >=11.4.1, <=11.4.11; >=11.8.1, <=11.8.7; =12.3.1

CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2026-48163 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 2. 6. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 15. 6. 2026.

CESNET, z.s.p.o. Logo