Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
MariaDB on AlmaLinux may allow malicious command execution
published 4 months ago
Summary
The MariaDB server and its backup utilities for AlmaLinux could be tricked into running commands that an attacker supplies through certain network operations. This could let an attacker take control of the database server or steal data. Apply the latest AlmaLinux MariaDB package updates without delay.
What to do
- Update almalinux mariadb to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-backup to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-common to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-devel to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-embedded to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-embedded-devel to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-errmsg to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-gssapi-server to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-oqgraph-engine to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-pam to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-server to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-server-galera to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-server-utils to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
- Update almalinux mariadb-test to version 3:10.5.29-1.el9_2.alma.1.tuxcare.els2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-backup |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-common |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-devel |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-embedded |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-embedded-devel |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-errmsg |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-gssapi-server |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-oqgraph-engine |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-pam |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-server |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-server-galera |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-server-utils |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
| TuxCare:AlmaLinux:9.2 | almalinux | mariadb-test |
< 3:10.5.29-1.el9_2.alma.1.tuxcare.els2 Fix: upgrade to 3:10.5.29-1.el9_2.alma.1.tuxcare.els2
|
Original advisory text
mariadb: Fix of 5 CVEs
- CVE-2026-49261: reject shell-unsafe characters in Galera joiner node
name and incoming address before interpolating into wsrep_notify_cmd
- CVE-2026-48165: validate wsrep_sst_receive_address and wsrep_sst_donor
for accepted characters to block SST shell command injection
- CVE-2026-44168: add safe() helper and validate joiner-supplied params
in the mariabackup SST donor path against shell command injection
- CVE-2026-48163: validate joiner-supplied parameters in the rsync SST
donor path against shell command injection
- CVE-2026-44172: correct big5 lead/tail byte validation in the bundled
Connector/C so mysql_real_escape_string cannot be bypassed via big5
name and incoming address before interpolating into wsrep_notify_cmd
- CVE-2026-48165: validate wsrep_sst_receive_address and wsrep_sst_donor
for accepted characters to block SST shell command injection
- CVE-2026-44168: add safe() helper and validate joiner-supplied params
in the mariabackup SST donor path against shell command injection
- CVE-2026-48163: validate joiner-supplied parameters in the rsync SST
donor path against shell command injection
- CVE-2026-44172: correct big5 lead/tail byte validation in the bundled
Connector/C so mysql_real_escape_string cannot be bypassed via big5
References
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783357653.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44168 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44172 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-48163 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-48165 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-49261 Vendor Advisory
Timeline
Published6 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1783357653 · OSV
Track software like this
Free during beta