CVE-2026-44168

Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.25 MariaDB server versions 10.11.1 through 10.11.16 MariaDB server versions 11.4.1 through 11.4.10 MariaDB server versions 11.8.1 through 11.8.6 MariaDB server version 12.3.1

Description During the State Snapshot Transfer (SST), the donor node interpolates parameters sent by the joiner into the command line. Due to improper validation of these parameters, a malicious joiner can execute arbitrary shell commands on the donor side when using the mariabackup SST method.

Recommendations Update versions 10.6.1 through 10.6.25 to 10.6.26. Update versions 10.11.1 through 10.11.16 to 10.11.17. Update versions 11.4.1 through 11.4.10 to 11.4.11. Update versions 11.8.1 through 11.8.6 to 11.8.7. Update version 12.3.1 to 12.3.2.