Skip to main content

MariaDB EUVDEUVD-2026-36269

| CVE-2026-49261 CRITICAL
OS Command Injection (CWE-78)
2026-06-11 GitHub_M
Command Injection MariaDB Server
9.8
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 30, 2026

OS command injection in MariaDB Server (CWE-78) lets an attacker achieve remote code execution on Galera cluster nodes by embedding shell metacharacters in a joiner node's name, which the server passes unsanitized to the script defined in wsrep_notify_cmd. Affected branches are 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1, but only when wsrep_notify_cmd is configured. It carries a vendor CVSS of 9.8; however EPSS is very low (0.05%, 15th percentile) and SSVC marks exploitation as 'none', so there is no public exploit identified at time of analysis and it is not on CISA KEV.

Earlier versions of this analysis (2)
v2 Jun 30, 2026 - 03:28 cvss changed CVSS 9.8

OS command injection in MariaDB Server lets an attacker who can influence the joiner node name in a Galera/wsrep cluster execute arbitrary shell commands on the host whenever wsrep_notify_cmd is configured. It affects 10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, and 12.3.1, carries a vendor CVSS of 9.8 (CWE-78), and is fixed in 10.6.27/10.11.18/11.4.12/11.8.8/12.3.2. There is no public exploit identified at time of analysis and EPSS is very low (0.05%), but SSVC rates technical impact as total and automatable.

v1 Jun 11, 2026 - 18:16 CVSS 10.0

Remote command injection in MariaDB Server (Galera cluster mode) allows unauthenticated attackers to execute arbitrary shell commands on cluster nodes by embedding shell metacharacters in a joining node's name when wsrep_notify_cmd is enabled. Affected branches include 10.6.x, 10.11.x, 11.4.x, 11.8.x and 12.3.1, with maximum CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) and no public exploit identified at time of analysis.

Affected VersionsENISA

Server 10.6.1, < 10.6.27
Server 11.8.1, < 11.8.8
Server = 12.3.1
Server 11.4.1, < 11.4.12
Server 10.11.1, < 10.11.18

Affected Packages

euvd server fix: 10.6.27, 10.11.18, 11.4.12, 11.8.8

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when MariaDB gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY CRITICAL
NVD 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.6 MEDIUM

Requires a non-default Galera config plus the ability to control cluster joiner names (privileged cluster participation), so AC:H and PR:H, but yields full host compromise (C/I/A:H).

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 9.0 CRITICAL
AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat 9.0 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jun 30, 2026 - 03:29 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 03:28 vuln.today
v2 - CVSS changed
CVSS changed
Jun 30, 2026 - 03:24 NVD
10.0 (CRITICAL) 9.8 (CRITICAL)
Patch available
Jun 11, 2026 - 19:01 EUVD
CVE Published
Jun 11, 2026 - 17:13 cve.org
CRITICAL 10.0

DescriptionNVD

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with wsrep_notify_cmd enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable wsrep_notify_cmd.

Articles & Coverage 1

letchupkt.medium.com CVE-2026-49261: MariaDB Galera Cluster RCE via Unsanitized wsrep_notify_cmd Node Name Injection Aug 08, 2026

Executive ViewAI

Why It Matters

MariaDB Galera cluster deployments with wsrep_notify_cmd enabled are vulnerable to remote code execution when attackers can introduce malicious node identifiers that bypass input validation in cluster notifications. No public exploit has been identified at time of analysis; current exploitation risk remains minimal per EPSS scoring, enabling structured response without emergency escalation.

Recommended Action

24 hours: Inventory all MariaDB Server instances running versions 10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, or 12.3.1 and confirm which have wsrep_notify_cmd configured. 7 days: Apply vendor-released patches (versions 10.6.27+, 10.11.18+, 11.4.12+, 11.8.8+, 12.3.2+) in a test environment first, then production. 30 days: Verify patch deployment across all production Galera clusters.

Business Impact: High
Compensating Controls

Apply vendor patch. If deployment timeline exceeds 7 days, disable wsrep_notify_cmd configuration if cluster event notifications are not operationally critical.

Threat Intelligence Overview

EPSS Score
0.0%
Top 85% exploitable
Threat Intel
1
1 source
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment NEWS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

More in MariaDB

View all
CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
CVE-2012-5613 MEDIUM POC
6.0 Dec 03

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2012-2122 MEDIUM POC
5.1 Jun 26

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
CVE-2012-5612 MEDIUM POC
6.5 Dec 03

Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly ot
CVE-2012-5611 MEDIUM POC
6.5 Dec 03

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53
CVE-2014-3470 MEDIUM
4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
CVE-2016-6664 HIGH POC
7.0 Dec 13

mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
CVE-2014-0221 MEDIUM
4.3 Jun 05

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.
CVE-2015-3152 MEDIUM POC
5.9 May 16

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the
CVE-2022-0778 HIGH POC
7.5 Mar 15

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:25143 ADVISORY https://access.redhat.com/errata/RHSA-2026:25145 ADVISORY https://ubuntu.com/security/notices/USN-8536-1 ADVISORY https://vuldb.com/vuln/370448 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22095/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2282/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2284/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2330/ REF https://access.redhat.com/errata/RHSA-2026:33093 REF https://access.redhat.com/errata/RHSA-2026:33412 REF https://access.redhat.com/errata/RHSA-2026:33464 REF https://access.redhat.com/errata/RHSA-2026:33481 REF https://access.redhat.com/errata/RHSA-2026:33482 REF https://access.redhat.com/errata/RHSA-2026:49522 REF https://access.redhat.com/errata/RHSA-2026:52848 REF https://access.redhat.com/errata/RHSA-2026:54142 REF https://access.redhat.com/security/cve/CVE-2026-49261 REF https://bugzilla.redhat.com/show_bug.cgi?id=2487957 REF https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw REF https://jira.mariadb.org/browse/MDEV-39721 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy