Executive brief
MariaDB is a widely used database server for storing and managing business data. A critical security flaw allows an attacker to execute unauthorized commands on the server by joining a database cluster with a specially crafted node name. This could lead to a total system takeover, theft of sensitive data, or complete service disruption.
Technical details
An OS command injection vulnerability (CWE-78) exists in MariaDB's Galera Cluster implementation. The `wsrep_notify_status()` function fails to sanitize peer-supplied fields, specifically `wsrep_node_name` and `wsrep_node_incoming_address`, before interpolating them into a command string executed via `sh -c`. A remote attacker can join the cluster as a 'joiner node' and use shell metacharacters in these fields to execute arbitrary commands on all cluster members where `wsrep_notify_cmd` is enabled. This is a network-based attack requiring no prior authentication. Patches are available in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
Affected products
- MariaDB MariaDB Server 10.6.1-10.6.26, 10.11.1-10.11.17, 11.4.1-11.4.11, 11.8.1-11.8.7, 12.3.1, 13.0
Timeline
- 2026-05-22: disclosed: Issue reported and resolved in internal tracker
- 2026-06-02: advisory: GitHub security advisory published
- 2026-06-11: advisory: NVD publication date