Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-49261: MariaDB packages on Debian 13 may allow code execution
CVE-2026-49261 · published today
Summary
The MariaDB server and client packages supplied for Debian 13 have a security gap that could let an attacker run unauthorized commands or access data. Update the MariaDB packages (including mariadb-min, mysql-client, and related components) to the latest versions provided by Debian as soon as possible to close the risk.
What to do
- Update mariadb-min to version 12.3.2.
- Update mysql-client to version 12.3.2.
- Update bellsoft mariadb to version 10.6.27-r0.
- Update debian rootio-mariadb to version 1:11.8.6-0+deb13u1.root.io.2.
- Update debian rootio-mariadb to version 1:10.11.14-0+deb12u2.root.io.7.
- Update mariadb to version 12.3.2.
- Update canonical mariadb to version 1:11.8.6-5ubuntu0.1.
- Update debian rootio-mariadb to version 1:10.11.14-0+deb12u2.root.io.6.
- Update debian rootio-mariadb to version 1:11.8.6-0+deb13u1.root.io.3.
- Update debian rootio-mariadb to version 1:11.8.6-0+deb13u1.root.io.5.
- Update debian mariadb to version 1:11.8.6-0+deb13u1.root.io.6.
- Update debian rootio-mariadb to version 1:11.8.6-0+deb13u1.root.io.6.
- Update bellsoft mariadb to version 11.8.8-r0.
- Update mariadb to version 1:11.8.6-0+deb13u1.aikido.9.
- Update rootio-mariadb to version 1:11.8.6-0+deb13u1.aikido.9.
- Update mariadb to version 1:11.8.6-0+deb13u1.aikido.10.
- Update rootio-mariadb to version 1:11.8.6-0+deb13u1.aikido.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | mariadb-min |
>= 12.3.1, < 12.3.2 Fix: upgrade to 12.3.2
|
| Bitnami | – | mysql-client |
>= 12.3.1, < 12.3.2 Fix: upgrade to 12.3.2
|
| – | mariadb | mariadb |
>= 10.6.1, < 10.6.27 >= 10.11.1, < 10.11.18 >= 11.4.1, < 11.4.12 >= 11.8.1, < 11.8.8 12.3.1 cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* |
| Debian:12 | debian | mariadb | All versions |
| Debian:13 | debian | mariadb | All versions |
| Debian:14 | debian | mariadb | All versions |
| Alpaquita:23 | bellsoft | mariadb |
>= 10.6.12-r0, < 10.6.27-r0 Fix: upgrade to 10.6.27-r0
|
| Ubuntu:16.04:LTS | canonical | mariadb-10.0 | All versions |
| Ubuntu:18.04:LTS | canonical | mariadb-10.1 | All versions |
| Ubuntu:20.04:LTS | canonical | mariadb-10.3 | All versions |
| Ubuntu:22.04:LTS | canonical | mariadb-10.6 | All versions |
| Ubuntu:24.04:LTS | canonical | mariadb | All versions |
| Ubuntu:25.10 | canonical | mariadb | All versions |
| Ubuntu:26.04:LTS | canonical | mariadb |
< 1:11.8.6-5ubuntu0.1 Fix: upgrade to 1:11.8.6-5ubuntu0.1
|
| Root:Debian:13 | debian | rootio-mariadb |
< 1:11.8.6-0+deb13u1.root.io.2 < 1:11.8.6-0+deb13u1.root.io.3 < 1:11.8.6-0+deb13u1.root.io.5 < 1:11.8.6-0+deb13u1.root.io.6 Fix: upgrade to 1:11.8.6-0+deb13u1.root.io.2
|
| Root:Debian:12 | debian | rootio-mariadb |
< 1:10.11.14-0+deb12u2.root.io.7 < 1:10.11.14-0+deb12u2.root.io.6 Fix: upgrade to 1:10.11.14-0+deb12u2.root.io.7
|
| Bitnami | – | mariadb |
>= 12.3.1, < 12.3.2 Fix: upgrade to 12.3.2
|
| – | mariadb | server | >= 10.6.1, < 10.6.27 |
| Root:Debian:13 | debian | mariadb |
< 1:11.8.6-0+deb13u1.root.io.6 Fix: upgrade to 1:11.8.6-0+deb13u1.root.io.6
|
| Alpaquita:stream | bellsoft | mariadb |
>= 10.11.4-r0, < 11.8.8-r0 Fix: upgrade to 11.8.8-r0
|
| Root:Debian:13 | – | mariadb |
< 1:11.8.6-0+deb13u1.aikido.9 < 1:11.8.6-0+deb13u1.aikido.10 Fix: upgrade to 1:11.8.6-0+deb13u1.aikido.9
|
| Root:Debian:13 | – | rootio-mariadb |
< 1:11.8.6-0+deb13u1.aikido.9 < 1:11.8.6-0+deb13u1.aikido.10 Fix: upgrade to 1:11.8.6-0+deb13u1.aikido.9
|
Original advisory text
CVE-2026-49261 in mariadb - Patched by Root
Root has patched CVE-2026-49261 in the mariadb package for Root:Debian:13. Multiple fixed versions available.
References
- https://security-tracker.debian.org/tracker/CVE-2026-49261 Vendor Advisory
- https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-49261 Third Party Advisory
- https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-49261 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8536-1 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49261... Vendor Advisory
- https://jira.mariadb.org/browse/MDEV-39721 Issue Tracking
- https://access.redhat.com/errata/RHSA-2026:25143
- https://nvd.nist.gov/vuln/detail/CVE-2026-49261 URL
- https://access.redhat.com/errata/RHSA-2026:49522
- https://access.redhat.com/errata/RHSA-2026:33481
- https://access.redhat.com/errata/RHSA-2026:52848
- https://access.redhat.com/errata/RHSA-2026:33482
- https://access.redhat.com/errata/RHSA-2026:33093
- https://access.redhat.com/errata/RHSA-2026:33464
- https://bugzilla.redhat.com/show_bug.cgi?id=2487957
- https://access.redhat.com/errata/RHSA-2026:33412
- https://access.redhat.com/errata/RHSA-2026:54142
- https://access.redhat.com/errata/RHSA-2026:25145
- https://access.redhat.com/security/cve/CVE-2026-49261
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json
- https://docs.bell-sw.com/security/cves/CVE-2026-49261 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-78OS Command Injection
Timeline
Published16 Oct 2026
Updated16 Oct 2026
First seen7 Jun 2026
Sources
DEBIAN-CVE-2026-49261 · OSV
BELL-CVE-2026-49261 · OSV
UBUNTU-CVE-2026-49261 · OSV
GHSA-3p3m-4x7c-p4pw · GHSA
CVE-2026-49261 · OSV
CVE-2026-49261 · NVD
CVE-2026-49261 · MITRE
BIT-mariadb-2026-49261 · OSV
Track software like this
Free during beta