CVE-2026-49261: MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

Synopsis

This is an OS command injection vulnerability in MariaDB Server affecting the `wsrep_notify_cmd` Galera cluster notification feature. When the feature is enabled, a remote unauthenticated attacker can embed shell commands in the name of a joining cluster node, and MariaDB will execute those commands on the server host. Successful exploitation gives the attacker full remote code execution on the database host, with the ability to read, modify, or destroy data and disrupt service. A patched-image rebuild at the fixed versions (10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the MariaDB Galera cluster port over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No database credentials or OS account are needed; the malicious node name is supplied before any authentication takes place during the cluster join handshake.

• Victim interactionNot required

  No human action is required; the server processes the malicious node name automatically when a join is initiated.

• Attack complexityDetail

  The exploit is reliable and condition-free: sending a crafted node name triggers command execution deterministically with no race conditions or memory-layout dependencies.

Blast Radius

• Executes arbitrary OS commands on the database server host under the privileges of the MariaDB process user.
• Reads any file accessible to the MariaDB process, including stored credentials, configuration files, and the full database contents.
• Writes or overwrites files on the host filesystem, enabling persistence mechanisms such as cron jobs or SSH authorized-key injection.
• Crashes or hangs the MariaDB service, causing a full database outage for all dependent applications.