CVE-2026-44168: MariaDB: wsrep SST unsafe parameter handling on the donor side

Synopsis

This is a command injection vulnerability in MariaDB server affecting the Galera cluster State Snapshot Transfer (SST) process, specifically the mariabackup SST method. The donor node (the cluster member sending database state to a new joiner) interpolates parameters received from the joiner into a shell command line without fully validating them, allowing a malicious joiner node to inject arbitrary shell commands that execute on the donor. Exploitation requires network access to the cluster replication port and a high-privilege (admin-level) account, but success grants the attacker full control over the donor host. Patched versions (10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2) exist upstream, and patched-image rebuilds at those versions are available on HarborGuard for environments running an affected MariaDB release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MariaDB Galera cluster replication interface over the network, as the SST mechanism is exposed to joiner nodes communicating across the network.

• AuthenticationRequired

  A high-privilege (admin-level) MariaDB account is needed for the malicious joiner node to participate in the SST handshake and supply crafted parameters to the donor.

• Victim interactionNot required

  No human interaction is required; the exploit is triggered automatically when the donor node processes SST parameters supplied by the malicious joiner.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker may need to satisfy specific environmental conditions or timing constraints, such as orchestrating a legitimate-looking joiner node join event against a reachable donor.

Blast Radius

• The attacker executes arbitrary shell commands on the donor node with the privileges of the MariaDB process, giving full operating-system-level access to that host.
• All database files accessible to the MariaDB process on the donor are readable, exposing stored table data, credentials, and configuration secrets.
• The attacker can modify or delete database files and host filesystem contents, corrupting persisted data across the affected cluster member.
• The donor node service can be crashed or rendered unavailable, disrupting cluster replication and potentially stalling the entire Galera cluster.