CVE-2026-49261

A flaw was found in MariaDB server. When the wsrep_notify_cmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the affected system.

Red Hat has assessed this vulnerability as Important. Exploitation requires the wsrep_notify_cmd server variable to be explicitly set to a notification script by the administrator. This variable is empty by default in the upstream configuration, and Red Hat's shipped Galera configuration additionally defaults to wsrep_on=0. Additionally, the attacker must stand up a MariaDB/Galera node that is accepted into the cluster membership view in order to inject a malicious node name.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.