CVE-2026-49261

When the `wsrep_notify_cmd` option is enabled, the MariaDB server executes the configured shell command to notify about Galera cluster events. The vulnerability exists because the joiner node name is inserted into the shell call without proper sanitization. An attacker can place malicious shell commands in the node name, which will be executed by the server when the node joins the cluster.

An attacker can execute arbitrary system commands with the privileges of the MariaDB server process, which in practice means complete control over the system — data theft, malware installation, and breach of confidentiality, integrity, and availability of the environment.

Update MariaDB to version: 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2. As a temporary workaround, if an update is not immediately possible, disable the `wsrep_notify_cmd` option in the server configuration.

MariaDB Server in versions: 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1 — only when the `wsrep_notify_cmd` option is enabled.