Skip to content
OpenAdvisories
Critical RHSA-2026:52848 1 CVE

Red Hat Security Advisory: mariadb:10.11 security update

Published Aug 11, 2026 · Updated Aug 12, 2026

Ecosystem: Red Hat

Fixed packages 27

ReleasePackageFixed in
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream galera 0:26.4.16-1.module+el9.4.0+21205+b026b850
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream galera-debuginfo 0:26.4.16-1.module+el9.4.0+21205+b026b850
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream galera-debugsource 0:26.4.16-1.module+el9.4.0+21205+b026b850
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-backup 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-backup-debuginfo 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-common 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-debuginfo 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-debugsource 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-devel 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-embedded 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-embedded-debuginfo 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-embedded-devel 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-errmsg 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-gssapi-server 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-gssapi-server-debuginfo 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-oqgraph-engine 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-oqgraph-engine-debuginfo 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-pam 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-pam-debuginfo 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-server 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-server-debuginfo 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-server-galera 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-server-utils 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-server-utils-debuginfo 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-test 3:10.11.18-1.module+el9.4.0+24597+6b9092cf
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream mariadb-test-debuginfo 3:10.11.18-1.module+el9.4.0+24597+6b9092cf

Vulnerabilities 1

  • Critical 10.0
    CVE-2026-49261

    MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

    MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the nam…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487957
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52848.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-49261
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49261
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49261
  • article
    https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw
  • article
    https://jira.mariadb.org/browse/MDEV-39721