CVE-2026-49261Disclosure(mariadb / mariadb)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch mariadb mariadb systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

mariadb CVEs Back to dashboard

0.8/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mariadb

Threat summary

Patch or workaround signal is available
14 mentions across 10 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 7 signals
Technical details provided in 11 signals
Disclosure: 7 classified signals
General: 3 classified signals
Peaked 9d ago at 2 mentions (2026-06-07); latest day: 1
14 total mentions across 10 days

Affected systems

Vendors

mariadb

Products

mariadb

1 version affected across 1 product

Deep dive

Activity timeline14 mentions / 10d

Signal classification3 categories

Disclosure

750.0%

Patch

428.6%

General

321.4%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-07	2	Disclosure1Patch1
2026-06-08	2	General1Patch1
2026-06-11	1	Disclosure1
2026-06-12	2	Patch2
2026-06-15	1	Disclosure1
2026-06-19	1	General1
2026-06-23	1	General1
2026-06-30	1	Disclosure1
2026-07-19	2	Disclosure2
2026-08-15	1	Disclosure1

Full discourse14 posts

yousukezan@yousukezan136d
Disclosure
MariaDB Community Serverに複数の脆弱性が見つかり、うち1件はCVSSスコア10.0の最高評価を受けた。最も深刻な脆弱性は「CVE-2026-49261」で、CVSS基本値は10.0。詳細な技術情報は現時点で公開されていない。このほか、「CVE-2026-48165」と「CVE-2026-48163」の2件もCVSS 8.0の高リスク脆弱性として報告された。対象となるのはMariaDB Community Server 11.8.8未満、11.4.12未満、10.11.18未満、10.6.27未満の各バージョン。記事では、これらの問題への対策として、ベンダーが提供する保守アップデートを速やかに適用することを推奨している。また、クエリログを継続的に監視し、不審な管理操作の兆候を早期に検知することも勧めている。 https://securityonline.info/mariadb-security-flaw-cvss-10/
Post summary
The article announces three new MariaDB Community Server vulnerabilities, including the high‑severity CVE‑2026‑49261, and urges users to apply vendor patches and monitor logs, but provides no exploit details.
08141656317.6K
14.5K followersView on X
Wazuh@wazuh114d
Disclosure
MariaDB Server is affected by CVE-2026-49261 (CVSS 10.0 - Critical), a command execution flaw that may execute shell commands via malicious joiner node names when wsrep_notify_cmd is enabled. Upgrade or disable wsrep_notify_cmd. Read on: https://ow.ly/kXHP50ZiJM0 https://t.co/w3LK9i5SwD
Post summary
MariaDB Server is affected by CVE‑2026‑49261, a critical command‑execution flaw via wsrep_notify_cmd; immediate upgrade or disable the feature to remediate.
013128153.1K
8.2K followersView on X
ransomNews@ransomnews67d
Disclosure
🚨 Critical #MariaDB flaw enables remote code execution CVE-2026-49261 can run arbitrary commands on vulnerable servers. 🔗 read more: https://securityonline.info/mariadb-remote-code-execution/ #ransomNews #cybersecurity
Post summary
A new critical MariaDB vulnerability (CVE-2026-49261) enabling remote code execution has been disclosed, but no PoC, exploit, active exploitation evidence, or patch details were provided.
02083907
3.6K followersView on X
AI Heartland@peaks2314136d
Patch
MariaDB Galera RCE脆弱性 CVE-2026-49261（CVSS 10.0）｜影響確認とパッチ手順 https://ai-heartland.com/security/mariadb-galera-rce-cve-2026-49261/
Post summary
The article announces the MariaDB Galera RCE vulnerability CVE-2026-49261, confirms its impact, and provides patch instructions, but does not mention active exploitation or a PoC.
00060168
3.4K followersView on X
CCB Alert@CCBalert129d
Disclosure
Warning: Critical OS Command Injection in #MariaDB. CVE-2026-49261 CVSS: 10 Unauthenticated, remote attackers without user interaction can exploit it to execute arbitrary shell commands. #Patch #Patch #Patch
Post summary
The text alerts to a critical OS Command Injection issue in MariaDB (CVE-2026-49261) with a CVSS score of 10, but offers no evidence of existing exploits, patches, or active exploitation.
02001261
7.2K followersView on X
PurpleOps@PurpleOps_io136d
Patch
a CVSS 10.0 in MariaDB (CVE-2026-49261) with the technical details still embargoed. you do not get to wait for the writeup on a perfect-score bug running on millions of servers. patch to 11.8.8 / 11.4.12 / 10.11.18 / 10.6.27. two more 8.0s ride along. https://securityonline.info/mariadb-security-flaw-cvss-10/ https://t.co/AwR1i3hEvQ
Post summary
The post announces that MariaDB CVE‑2026‑49261 has a CVSS score of 10.0 and provides immediate patch versions, while technical details remain embargoed.
01011188
598 followersView on X
CERT-PY@CERTpy121d
General
⚠️ Vulnerabilidades en productos MariaDB ❗ CVE-2026-49261 ❗ CVE-2026-48165 ❗ CVE-2026-48163 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-mariadb/ https://t.co/qNTKkpUtZ3
Post summary
The tweet lists three MariaDB CVEs and provides links for additional information, without offering technical specifics, exploit details, or mitigation guidance.
00011271
6.7K followersView on X
Upwind Security MDR@UpwindMDR132d
Disclosure
🚨 Critical - MariaDB Galera Cluster Command Injection (CVE-2026-49261) MariaDB servers with wsrep_notify_cmd enabled may execute shell commands embedded in the name of a joining cluster node, potentially allowing unauthenticated remote code execution. 👉 Affected: 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, 12.3.1 | Fix: 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2
Post summary
A critical command‑injection flaw (CVE‑2026‑49261) in MariaDB Galera Cluster permits unauthenticated remote code execution via wsrep_notify_cmd, affecting multiple release ranges; patch versions are supplied for remediation.
0101069
216 followersView on X
Lyrie.ai@lyrie_ai95d
Disclosure
Vendor v10.0. 0day Intel: MariaDB Server is affected by CVE-2026-49261 (CVSS 10.0 - Critical), a command e
Post summary
A critical MariaDB Server vulnerability (CVE‑2026‑49261) has been disclosed with a CVSS 10.0 score, but no PoC, exploit, or patch details are provided.
1000039
326 followersView on X
Lyrie.ai@lyrie_ai95d
Disclosure
CVE-2026-49261. 0day Intel: MariaDB Server is affected by CVE-2026-49261 (CVSS 10.0 - Critical), a command e
Post summary
MariaDB Server is affected by a critical CVE‑2026‑49261 (CVSS 10.0), but no PoC, exploit, or patch details are provided, and there is no evidence of current exploitation.
1000054
326 followersView on X
Kaitan ID Security@KaitanSecurity125d
General
🛡️ MariaDB, Boxlite, and Aqara: Infrastructure and IoT Exposure Three additional critical findings round out the week's infrastructure concerns. CVE-2026-49261 affects a wide range of MariaDB server versions across the 10.6, 10.11, and 11.4…
Post summary
The text notes that CVE-2026-49261 impacts various MariaDB server versions but provides no additional technical, exploit, patch, or usage details.
1000052
81 followersView on X
SecAlerts@SecAlertsCo132d
Patch
🗄️ MariaDB CVE-2026-49261: OS command injection via wsrep_notify_cmd — CVSS 10. No auth, no interaction, full system takeover. Five separate release lines across 10.6, 10.11, 11.4, 11.8 and 12.3 are affected. Patch now. https://secalerts.co/vulnerability/CVE-2026-49261 https://t.co/DFz1M2ZptK
Post summary
The tweet announces a MariaDB OS command injection vulnerability (CVE-2026-49261) with a critical CVSS score and notes that a patch is available; no evidence of active exploitation or PoC is provided.
0100070
835 followersView on X
CVETrends@CVEShield136d
General
Top 5 Trending CVEs: 1 - CVE-2026-9366 2 - CVE-2026-42945 3 - CVE-2026-46640 4 - CVE-2026-49261 5 - CVE-2020-0022 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
A brief list of trending CVEs is shared without any supporting technical, exploit, or mitigation details.
00010130
1.7K followersView on X
Upwind Security MDR@UpwindMDR131d
Patch
🚨High - MariaDB Galera SST Parameter Injection, Donor & Joiner Sides (CVE-2026-48163 & CVE-2026-48165) Two related command-injection flaws in MariaDB's Galera State Snapshot Transfer. In CVE-2026-48163, the rsync SST method on the donor node fails to validate joiner-supplied values like WSREP_SST_OPT_REMOTE_USER/PSWD before writing them into stunnel.conf and the rsync magic file. CVE-2026-48165 is the joiner-side counterpart via unsafe wsrep_sst_receive_address handling. In both cases an attacker positioned in the cluster sync flow can inject and execute arbitrary shell commands. They were patched together and ship alongside the critical wsrep_notify_cmd RCE (CVE-2026-49261, CVSS 10.0) - Galera users should treat the whole batch as one upgrade. 👉Upgrade to MariaDB 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2.
Post summary
The post announces two critical command‑injection flaws in MariaDB Galera SST, explains how they enable arbitrary shell execution, and urges users to upgrade to specific patched releases.
0000057
216 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mariadb	mariadb	-	-	-
App	mariadb	mariadb	12.3.1	-	-

Explore more

Back to dashboard mariadb CVEs mariadb vulnerabilities

What researchers are saying

CVE-2026-49261

yousukezan[verified]@yousukezanDisclosure

The article announces three new MariaDB Community Server vulnerabilities, including the high‑severity CVE‑2026‑49261, and urges users to apply vendor patches and monitor logs, but provides no exploit details.

ransomNews[verified]@ransomnewsDisclosure

A new critical MariaDB vulnerability (CVE-2026-49261) enabling remote code execution has been disclosed, but no PoC, exploit, active exploitation evidence, or patch details were provided.

AI Heartland[verified]@peaks2314Patch

The article announces the MariaDB Galera RCE vulnerability CVE-2026-49261, confirms its impact, and provides patch instructions, but does not mention active exploitation or a PoC.

PurpleOps[verified]@PurpleOps_ioPatch

The post announces that MariaDB CVE‑2026‑49261 has a CVSS score of 10.0 and provides immediate patch versions, while technical details remain embargoed.

Upwind Security MDR[verified]@UpwindMDRDisclosure

A critical command‑injection flaw (CVE‑2026‑49261) in MariaDB Galera Cluster permits unauthenticated remote code execution via wsrep_notify_cmd, affecting multiple release ranges; patch versions are supplied for remediation.

Lyrie.ai[verified]@lyrie_aiDisclosure

A critical MariaDB Server vulnerability (CVE‑2026‑49261) has been disclosed with a CVSS 10.0 score, but no PoC, exploit, or patch details are provided.

Lyrie.ai[verified]@lyrie_aiDisclosure

MariaDB Server is affected by a critical CVE‑2026‑49261 (CVSS 10.0), but no PoC, exploit, or patch details are provided, and there is no evidence of current exploitation.

Kaitan ID Security[verified]@KaitanSecurityGeneral

The text notes that CVE-2026-49261 impacts various MariaDB server versions but provides no additional technical, exploit, patch, or usage details.