Executive brief
MariaDB is a widely used database server for storing and managing corporate data. A security flaw in its cluster synchronization process allows a compromised or malicious server joining a cluster to execute unauthorized commands on an existing server. This could lead to full system takeover, data theft, or permanent disruption of database services.
Technical details
An OS command injection vulnerability (CWE-78) exists in MariaDB's wsrep SST (State Snapshot Transfer) process, specifically within the mariabackup method. The donor node fails to properly validate or sanitize parameters sent by a joiner node before interpolating them into a command-line string. For instance, fields like a certificate's CommonName can be manipulated to include shell metacharacters. An attacker with high privileges (sufficient to initiate a joiner request) can exploit this over the network to achieve arbitrary code execution on the donor node with the privileges of the MariaDB process. The issue is patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Affected products
- MariaDB MariaDB Server 10.6.1 to 10.6.25, 10.11.1 to 10.11.16, 11.4.1 to 11.4.10, 11.8.1 to 11.8.6, 12.3.1
Timeline
- 2026-04-22: other: Issue reported internally/via Jira
- 2026-04-27: patched: Issue resolved in development
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD