CVE-2026-44168

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44168
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44168.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44168
Aliases
Downstream
Related
Published
2026-06-12T17:31:26.921Z
Modified
2026-07-08T08:12:35.347077215Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
MariaDB: wsrep SST unsafe parameter handling on the donor side
Details

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44168.json",
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mariadb/server

Affected ranges

Type
GIT
Repo
https://github.com/mariadb/server
Events
Introduced
00a8357bd30fdfca23720448a3f638290b6d35b7
Fixed
d37e50c6d04c7c27362f1668ae86fa592b94fb23
Introduced
2437674291f31c91869a74eb6ebd9f03dc52bd43
Fixed
6828ff7390a6e46155343be2e8a1443b52b208b5
Introduced
fa69b085b10f19a3a8b6e7adab27c104924333ae
Fixed
10034c14cd9f8161014d1a0de45f8bec4c277487
Introduced
1c4aed7c680c0402d6e97e097f03815c0e9bf4c5
Fixed
e7d1202da30b7707185dc9b55af4693d1e3e4f60
Introduced
21a0714a118614982d20bfa504763d7247800091
Database specific 
{
    "cpe": [
        "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "10.6.1"
        },
        {
            "fixed": "10.6.26"
        },
        {
            "introduced": "10.11.1"
        },
        {
            "fixed": "10.11.17"
        },
        {
            "introduced": "11.4.1"
        },
        {
            "fixed": "11.4.11"
        },
        {
            "introduced": "11.8.1"
        },
        {
            "fixed": "11.8.7"
        },
        {
            "introduced": "12.3.1"
        },
        {
            "last_affected": "12.3.1"
        }
    ]
}

Affected versions

12.*
12.3.1
mariadb-10.*
mariadb-10.11.1
mariadb-10.11.10
mariadb-10.11.11
mariadb-10.11.12
mariadb-10.11.13
mariadb-10.11.14
mariadb-10.11.15
mariadb-10.11.16
mariadb-10.11.2
mariadb-10.11.6
mariadb-10.11.7
mariadb-10.11.8
mariadb-10.11.9
mariadb-10.6.1
mariadb-10.6.10
mariadb-10.6.11
mariadb-10.6.12
mariadb-10.6.13
mariadb-10.6.14
mariadb-10.6.16
mariadb-10.6.17
mariadb-10.6.18
mariadb-10.6.19
mariadb-10.6.2
mariadb-10.6.20
mariadb-10.6.21
mariadb-10.6.22
mariadb-10.6.23
mariadb-10.6.24
mariadb-10.6.25
mariadb-10.6.3
mariadb-10.6.4
mariadb-10.6.5
mariadb-10.6.6
mariadb-10.6.8
mariadb-10.6.9
mariadb-11.*
mariadb-11.4.1
mariadb-11.4.10
mariadb-11.4.11
mariadb-11.4.2
mariadb-11.4.3
mariadb-11.4.4
mariadb-11.4.5
mariadb-11.4.6
mariadb-11.4.7
mariadb-11.4.8
mariadb-11.4.9
mariadb-11.8.1
mariadb-11.8.2
mariadb-11.8.3
mariadb-11.8.4
mariadb-11.8.6
mariadb-11.8.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44168.json"