MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVSS Details
- CVSS 3.1 Base Score: 8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mariadb | Jun 18, 2026 | Jun 12, 2026 |
| Amazon_linux_2023 | — | Upgrade mariadb114-oqgraph-engine-debuginfoUpgrade mariadb114-pamUpgrade mariadb114-gssapi-server-debuginfoUpgrade mariadb114-client-utilsUpgrade mariadb114-serverUpgrade mariadb114-server-utilsUpgrade mariadb114-backupUpgrade mariadb114-cracklib-password-check-debuginfoUpgrade mariadb114-errmsgUpgrade mariadb114-sphinx-engine-debuginfoUpgrade mariadb114-server-utils-debuginfoUpgrade mariadb114-test-debuginfoUpgrade mariadb114-server-debuginfoUpgrade mariadb114-oqgraph-engineUpgrade mariadb114-pam-debuginfoUpgrade mariadb114-testUpgrade mariadb114-connect-engineUpgrade mariadb114-gssapi-serverUpgrade mariadb114-rocksdb-engineUpgrade mariadb114-debugsourceUpgrade mariadb114-cracklib-password-checkUpgrade mariadb114-connect-engine-debuginfoUpgrade mariadb114-debuginfoUpgrade mariadb114-sphinx-engineUpgrade mariadb114-develUpgrade mariadb114-backup-debuginfoUpgrade mariadb114Upgrade mariadb114-rocksdb-engine-debuginfoUpgrade mariadb114-common | Jun 23, 2026 | Jun 12, 2026 |
| Debian | — | Upgrade mariadb | Jul 12, 2026 | Jul 12, 2026 |
| Freebsd | — | Upgrade mariadb114-clientUpgrade mariadb118-clientUpgrade mariadb106-clientUpgrade mariadb114-serverUpgrade mariadb1011-serverUpgrade mariadb118-serverUpgrade mariadb1011-clientUpgrade mariadb106-server | May 21, 2026 | May 19, 2026 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Jun 26, 2026 | Jun 12, 2026 |
| Redhat_linux | — | Upgrade mariadb-develUpgrade mariadb-server-galeraUpgrade mariadb11.8-server-debuginfoUpgrade mariadbUpgrade mariadb-embedded-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb11.8-embedded-debuginfoUpgrade mariadb11.8-commonUpgrade mariadb11.8-oqgraph-engineUpgrade mariadb-commonUpgrade mariadb11.8-embedded-develUpgrade mariadb11.8-pam-debuginfoUpgrade galera-debuginfoUpgrade mariadb11.8-embeddedUpgrade mariadb11.8-debuginfoUpgrade mariadb11.8-backup-debuginfoUpgrade mariadb11.8-gssapi-serverUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb11.8-pamUpgrade mariadb11.8-debugsourceUpgrade mariadb-pamUpgrade mariadb11.8-test-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-errmsgUpgrade mariadb11.8-backupUpgrade JudyUpgrade mariadb-embedded-develUpgrade mariadb11.8-gssapi-server-debuginfoUpgrade mariadb-backupUpgrade mariadb-testUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-embeddedUpgrade mariadb11.8-develUpgrade mariadb10.11-debugsourceUpgrade mariadb10.11-debuginfoUpgrade mariadb11.8-client-utilsUpgrade mariadb-server-galera-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-oqgraph-engineUpgrade galera-debugsourceUpgrade mariadb11.8-server-utilsUpgrade mariadb11.8Upgrade mariadb-serverUpgrade mariadb11.8-testUpgrade mariadb-gssapi-serverUpgrade galeraUpgrade mariadb11.8-serverUpgrade mariadb11.8-errmsgUpgrade Judy-debuginfoUpgrade mariadb11.8-server-galeraUpgrade mariadb-debugsourceUpgrade mariadb-client-utilsUpgrade mariadb-pam-debuginfoUpgrade mariadb-debuginfoUpgrade Judy-debugsourceUpgrade mariadb11.8-oqgraph-engine-debuginfoUpgrade mariadb11.8-server-galera-debuginfo | Jul 3, 2026 | Jun 12, 2026 |
| Rocky_linux | — | Upgrade mariadb11.8-server-galeraUpgrade mariadb-gssapi-serverUpgrade mariadb-pamUpgrade mariadb-server-utilsUpgrade mariadb-testUpgrade mariadb11.8-serverUpgrade mariadb-embeddedUpgrade mariadbUpgrade mariadb-server-utils-debuginfoUpgrade mariadb11.8-develUpgrade mariadb11.8-backup-debuginfoUpgrade mariadb11.8-server-galera-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-debuginfoUpgrade mariadb11.8-server-debuginfoUpgrade Judy-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb11.8-embedded-develUpgrade mariadb11.8-gssapi-serverUpgrade mariadb-server-debuginfoUpgrade JudyUpgrade mariadb-debugsourceUpgrade mariadb11.8-gssapi-server-debuginfoUpgrade mariadb-develUpgrade mariadb11.8-embeddedUpgrade mariadb11.8Upgrade mariadb10.11-debuginfoUpgrade mariadb11.8-backupUpgrade mariadb-commonUpgrade mariadb-client-utilsUpgrade mariadb11.8-pamUpgrade mariadb11.8-oqgraph-engineUpgrade Judy-debugsourceUpgrade mariadb11.8-oqgraph-engine-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-debuginfoUpgrade mariadb-pam-debuginfoUpgrade mariadb-server-galera-debuginfoUpgrade galera-debuginfoUpgrade mariadb-errmsgUpgrade mariadb10.11-debugsourceUpgrade mariadb11.8-embedded-debuginfoUpgrade mariadb11.8-test-debuginfoUpgrade mariadb11.8-testUpgrade mariadb11.8-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-backupUpgrade galera-debugsourceUpgrade mariadb11.8-pam-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade galeraUpgrade mariadb11.8-debugsourceUpgrade mariadb-server-galeraUpgrade mariadb-server | Jul 3, 2026 | Jun 30, 2026 |
| Ubuntu | — | Upgrade mariadb-server | Jul 14, 2026 | Jun 12, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 29, 2026 | Jun 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub