CVE-2026-49261 -- CVSS 10.0 Vulnerability Briefing

CVE-2026-49261 | CVSS 10.0 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-49261 is a critical severity vulnerability in MariaDB Server, a widely deployed open-source relational database, affecting multiple release branches across versions 10.6, 10.11, 11.4, 11.8, and 12.3 when the wsrep_notify_cmd configuration option is enabled.

Technical Detail

The flaw is associated with the Galera cluster notification command interface (wsrep_notify_cmd), a feature that allows MariaDB to invoke external scripts upon cluster state changes. Based on the description and the CVSS score of 10.0, the vulnerability likely permits unauthenticated or low-privilege remote code execution by injecting malicious input into the notify command path, allowing arbitrary OS-level command execution under the database process account. A successful exploit would give an attacker full control over the underlying host, including access to all database contents and the ability to pivot further into the environment.

Exploitation Status

No known exploit exists for this vulnerability at this time. It is not listed in the CISA Known Exploited Vulnerabilities catalog as of June 18, 2026. Exploit maturity is currently assessed as none, meaning no public proof-of-concept or weaponized code has been confirmed. However, the CVSS 10.0 score and the nature of the affected component make this a high-priority target for future exploitation development.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this CVE as of the date of this briefing.

What To Do

Organizations running MariaDB in the affected version ranges should prioritize patching to the latest available fixed release for their respective branch. As an immediate workaround, administrators who do not require Galera cluster notification functionality should disable or leave unset the wsrep_notify_cmd configuration directive, which removes the vulnerable attack surface entirely. Deployments using Galera clustering in production environments should treat this as an urgent patch cycle given the maximum CVSS score. Audit database server configurations to confirm whether wsrep_notify_cmd is set, and review system logs for unexpected child process spawning from the MariaDB process as a potential detection signal. Monitor the MariaDB security advisories page for official patch confirmation and version-specific guidance.