CVE-2026-44168: MariaDB Server Command Injection via SST Joiner Parameters

Technical summary

During State Snapshot Transfer (SST) via mariabackup, the donor node constructs and executes shell commands that incorporate parameters supplied by the joiner without sufficient sanitization. The vulnerability stems from inadequate input validation of joiner-supplied parameters before they are interpolated into command-line arguments. An attacker with high privileges on a joiner node can inject shell metacharacters to break out of intended command boundaries and execute arbitrary shell commands with the privileges of the MariaDB process on the donor system. This is classified as a classic OS command injection vulnerability (CWE-78).

Business impact

Successful exploitation could compromise the integrity and availability of donor database nodes during replication operations. An attacker gaining code execution on a donor server could steal sensitive data, modify database contents, install persistence mechanisms, or disrupt cluster operations. Organizations relying on MariaDB clustering for mission-critical databases face significant risk if SST operations involve untrusted or compromised joiner nodes. Patch deployment is essential before performing any cluster expansion or recovery operations.

Affected systems

MariaDB Server versions 10.6.1 through 10.6.25, 10.11.1 through 10.11.16, 11.4.1 through 11.4.10, 11.8.1 through 11.8.6, and 12.3.1 are vulnerable. Patched versions are 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2. The vulnerability only affects deployments using the mariabackup SST method for cluster node synchronization.

Exploitability

Exploitation requires high-privilege database access to the joiner node attempting to join the cluster—a significant access prerequisite. However, the attack surface widens in environments where multiple database administrators, third-party tools, or containerized instances have elevated privileges. The network requirement (N) and high attack complexity (H) moderate the risk somewhat, but the high CVSS score (8.0) reflects the severe potential impact: complete compromise of the donor node across cluster boundaries.

Remediation

Upgrade MariaDB Server to patched versions immediately: 10.6.26 or later, 10.11.17 or later, 11.4.11 or later, 11.8.7 or later, or 12.3.2 or later, depending on your current branch. Before upgrading, audit which nodes in your cluster have high-privilege access and review SST operational procedures. Consider temporarily restricting cluster expansion operations until patches are deployed.

Patch guidance

Apply vendor patches according to your MariaDB version branch. Verify patch installation by checking the version output from MariaDB command line (SELECT VERSION();) and cross-reference against the patched version numbers provided by MariaDB. Test patches in a non-production environment first, particularly if your cluster uses mariabackup for regular backups or disaster recovery. Plan patching to minimize cluster disruption; patching one node at a time in a multi-node cluster is recommended.

Detection guidance

Monitor MariaDB process creation and shell command execution logs for unexpected child processes spawned from the MariaDB daemon, particularly during SST operations. Audit mariabackup invocations and their command-line arguments in system logs. Implement network-level monitoring for unusual SST traffic patterns. Review database access logs for privilege escalation or unusual joiner node registrations. Alert on any shell metacharacters (such as pipes, semicolons, or backticks) appearing in SST parameter logs.

Why prioritize this

HIGH priority for any organization running MariaDB with clustering enabled. The vulnerability combines high impact (full code execution on database servers) with a realistic threat model (insider threats or compromised cluster nodes). While the CVSS Access Vector is 'H' (high privileges required), databases are frequent targets; this should not be deprioritized relative to network-accessible vulnerabilities.

Risk score, explained

CVSS 3.1 score of 8.0 (HIGH) reflects: Network-accessible attack surface (AV:N), high attack complexity due to privilege requirements (AC:H), high-privilege prerequisite (PR:H), scope change across the database system boundary (S:C), and complete confidentiality, integrity, and availability impact (C:H/I:H/A:H). The score appropriately weights the severe consequences against the access barrier.

Frequently asked questions