Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M
CVE-2026-44168MariaDB: wsrep SST unsafe parameter handling on the donor side
High 8.0
In plain English
A high-severity OS command injection in server from MariaDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.6%top 51.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | Judy | 1.0.5-18.module_el8.10.0+3794+c6a66d65 | ALSA-2026:33464 |
| AlmaLinux:8 | Judy | 1.0.5-18.module_el8.10.0+3955+6534edaf | ALSA-2026:33464 |
| AlmaLinux:10 | galera | 26.4.27-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:8 | galera | 26.4.27-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | galera | 26.4.27-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:9 | galera | 26.4.27-1.module_el9.8.0+315+b08bed7e | ALSA-2026:33482 |
| AlmaLinux:9 | galera | 26.4.27-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:10 | mariadb | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:9 | mariadb | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:10 | mariadb-backup | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-backup | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-backup | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-backup | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-backup | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:10 | mariadb-client-utils | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:9 | mariadb-client-utils | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:10 | mariadb-common | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-common | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-common | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-common | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:9 | mariadb-common | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:10 | mariadb-devel | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-devel | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-devel | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-devel | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-devel | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:10 | mariadb-embedded | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-embedded | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-embedded | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-embedded | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-embedded | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:10 | mariadb-embedded-devel | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-embedded-devel | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-embedded-devel | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:9 | mariadb-embedded-devel | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-embedded-devel | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:10 | mariadb-errmsg | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-errmsg | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-errmsg | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-errmsg | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:10 | mariadb-gssapi-server | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-gssapi-server | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-gssapi-server | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-gssapi-server | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:9 | mariadb-gssapi-server | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:10 | mariadb-oqgraph-engine | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-oqgraph-engine | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-oqgraph-engine | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:9 | mariadb-oqgraph-engine | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-oqgraph-engine | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:10 | mariadb-pam | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-pam | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-pam | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-pam | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:9 | mariadb-pam | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:10 | mariadb-server | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-server | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-server | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-server | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:10 | mariadb-server-galera | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-server-galera | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-server-galera | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-server-galera | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:9 | mariadb-server-galera | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:10 | mariadb-server-utils | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-server-utils | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-server-utils | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-server-utils | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-server-utils | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:10 | mariadb-test | 3:10.11.18-1.el10_2.alma.1 | ALSA-2026:33093 |
| AlmaLinux:8 | mariadb-test | 3:10.11.18-1.module_el8.10.0+4207+a44b0e1e | ALSA-2026:33464 |
| AlmaLinux:9 | mariadb-test | 3:11.8.8-1.module_el9.8.0+274+ad8c02e7 | ALSA-2026:33481 |
| AlmaLinux:9 | mariadb-test | 3:10.11.18-1.module_el9.8.0+315+b08bed7e.alma.1 | ALSA-2026:33482 |
| AlmaLinux:9 | mariadb-test | 3:10.11.18-1.module_el9.8.0+275+ff40c56f | ALSA-2026:33482 |
| AlmaLinux:10 | mariadb11.8 | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-backup | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-client-utils | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-common | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-devel | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-embedded | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-embedded-devel | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-errmsg | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-gssapi-server | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-oqgraph-engine | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-pam | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-server | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-server-galera | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-server-utils | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| AlmaLinux:10 | mariadb11.8-test | 3:11.8.8-1.el10_2 | ALSA-2026:33412 |
| Alpine:v3.20 | mariadb | 10.11.17-r0 | ALPINE-CVE-2026-44168 |
| Alpine:v3.21 | mariadb | 11.4.11-r0 | ALPINE-CVE-2026-44168 |
| Alpine:v3.22 | mariadb | 11.4.11-r0 | ALPINE-CVE-2026-44168 |
| Alpine:v3.23 | mariadb | 11.4.11-r0 | ALPINE-CVE-2026-44168 |
| Alpine:v3.24 | mariadb | 11.8.7-r0 | ALPINE-CVE-2026-44168 |
| Debian:12 | mariadb | 1:10.11.18-0+deb12u1 | DEBIAN-CVE-2026-44168 |
| Debian:13 | mariadb | no fix listed | DEBIAN-CVE-2026-44168 |
| Debian:14 | mariadb | 1:11.8.8-1 | DEBIAN-CVE-2026-44168 |
| Rocky Linux:10 | galera | 0:26.4.27-1.el10_2 | RLSA-2026:33412 |
| Rocky Linux:9 | galera | 0:26.4.27-1.module+el9.8.0+40229+87be66a2 | RLSA-2026:33482 |
| Rocky Linux:9 | galera | 0:26.4.27-1.module+el9.8.0+40229+87be66a2 | RLSA-2026:33481 |
| Rocky Linux:9 | galera | 0:26.4.27-1.module+el9.8.0+40232+a354f53a | RLSA-2026:33481 |
| Rocky Linux:9 | galera | 0:26.4.27-1.module+el9.8.0+40232+a354f53a | RLSA-2026:33482 |
| Rocky Linux:9 | mariadb | 3:10.11.18-1.module+el9.8.0+40232+a354f53a | RLSA-2026:33482 |
| Rocky Linux:9 | mariadb | 3:11.8.8-1.module+el9.8.0+40229+87be66a2 | RLSA-2026:33481 |
| Rocky Linux:10 | mariadb10.11 | 3:10.11.18-1.el10_2 | RLSA-2026:33093 |
| Ubuntu:24.04:LTS | mariadb | no fix listed | UBUNTU-CVE-2026-44168 |
| Ubuntu:25.10 | mariadb | no fix listed | UBUNTU-CVE-2026-44168 |
| Ubuntu:26.04:LTS | mariadb | 1:11.8.6-5ubuntu0.1 | UBUNTU-CVE-2026-44168 |
| Ubuntu:22.04:LTS | mariadb-10.6 | no fix listed | UBUNTU-CVE-2026-44168 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h x_refsource_CONFIRM
- https://jira.mariadb.org/browse/MDEV-39413 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-44168 vdb-entry, x_refsource_REDHAT
- RHBZ#2488450 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:49522 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33093 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33412 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33464 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33482 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33481 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25145 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25143 vendor-advisory, x_refsource_REDHAT