VulnSocial

CVE-2026-44168Disclosure(mariadb / mariadb)

LOWCVSS 8.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch mariadb mariadb systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

mariadb CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mariadb

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-10); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
mariadb
Products
mariadb

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-10: 1Mentions · 2026-06-15: 1Patch / Workaround · 2026-06-15: 1Technical Details · 2026-06-15: 106-1006-15
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-101
Disclosure1
2026-06-151
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    #CVE-2026-44168 - Command Injection in #MariaDB. #CVSS 8. Unvalidated SST parameters allow joiner to execute commands on donor. Update immediately. #infosec #cybersecurity #pentester #100daysofcybersecurity #database #hackers More detailed info: https://www.valtersit.com/cve/CVE-2026-44168/

    Post summary

    The tweet reveals a command‑injection flaw in MariaDB (CVE‑2026‑44168) with a CVSS score of 8 and urges users to patch immediately.

    0000029
    929 followersView on X
  • セキュリティ対策Lab@securityLab_jp
    Disclosure

    MariaDBに重大な脆弱性(CVE-2026-3494,CVE-2026-44168,CVE-2026-44170,CVE-2026-44171,CVE-2026-44172,CVE-2026-44173) https://rocket-boys.co.jp/security-measures-lab/mariadb-critical-vulnerabilities-2026/ #セキュリティ対策Lab #security #securitynews

    Post summary

    The article announces critical MariaDB vulnerabilities (CVE‑2026‑3494, CVE‑2026‑44168‑44173) without providing PoC, exploit details, or mitigation information.

    00000100
    422 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appmariadbmariadb---
Appmariadbmariadb12.3.1--

Explore more

Back to dashboardmariadb CVEsmariadb vulnerabilities