Catalogo CVE

CVE-2026-44168

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during

[Catalogo CVE]

Gravità: High · CVSS 8CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Published: May 19, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.97% · Oct 22, 2026

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	mariadb	sid	`1:11.8.9+ds-4`	fixed
Debian	mariadb	forky	`1:11.8.9+ds-2`	fixed
Debian	mariadb	trixie	`1:11.8.6-0+deb13u1`	vulnerable
Debian	mariadb	bookworm	`1:10.11.18-0+deb12u1`	fixed
Debian	mariadb	bookworm-security	`1:10.11.19-0+deb12u1`	fixed
Cpe	mariadb	Not reported	`10.6.26`	fixed
Cpe	mariadb	Not reported	`10.11.17`	fixed
Cpe	mariadb	Not reported	`11.4.11`	fixed
Cpe	mariadb	Not reported	`11.8.7`	fixed
Cpe	mariadb	Not reported	Not reported	unknown
Cpe	mariadb	Not reported	`1:10.11.18-0+deb12u1`	fixed
Alpine	mariadb	3.20	`10.11.17-r0`	fixed
Alpine	mariadb	3.21	`11.4.11-r0`	fixed
Alpine	mariadb	3.22	`11.4.11-r0`	fixed
Alpine	mariadb	3.23	`11.4.11-r0`	fixed
Alpine	mariadb	3.24	`11.8.7-r0`	fixed
Ubuntu	mariadb-10.0	16.04	`10.0.20-0ubuntu0.15.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.22-0ubuntu1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.23-1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.23-2`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.24-7`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.25-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.27-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.28-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.29-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.31-0ubuntu0.16.04.2`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.33-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.34-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.36-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.0	16.04	`10.0.38-0ubuntu0.16.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`10.1.25-1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.29-6`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.34-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.38-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.38-0ubuntu0.18.04.2`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.40-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.41-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.43-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.44-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.47-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.1	18.04	`1:10.1.48-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.17-1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.18-1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.19-1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.21-2`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.22-1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.22-1ubuntu1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.25-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.29-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.30-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.31-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.32-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.34-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.37-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.38-0ubuntu0.20.04.1`	vulnerable
Ubuntu	mariadb-10.3	20.04	`1:10.3.39-0ubuntu0.20.04.2`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.7-2ubuntu1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.7-2ubuntu1.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.11-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.12-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.16-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.18-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.21-0ubuntu0.22.04.2`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.22-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb-10.6	22.04	`1:10.6.23-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.4-1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.5-3`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.6-1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.6-2`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.7-2ubuntu1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.7-2ubuntu2`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.8-0ubuntu0.24.04.1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.11-0ubuntu0.24.04.2`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.13-0ubuntu0.24.04.1`	vulnerable
Ubuntu	mariadb	24.04	`1:10.11.14-0ubuntu0.24.04.1`	vulnerable
Ubuntu	mariadb	25.10	`1:11.4.5-1`	vulnerable
Ubuntu	mariadb	25.10	`1:11.8.1-4`	vulnerable
Ubuntu	mariadb	25.10	`1:11.8.1-5ubuntu2`	vulnerable
Ubuntu	mariadb	25.10	`1:11.8.2-1ubuntu1`	vulnerable
Ubuntu	mariadb	25.10	`1:11.8.3-1`	vulnerable
Ubuntu	mariadb	25.10	`1:11.8.3-1build1`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.3-1build1`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.5-1`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.5-2`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.5-3`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.5-4`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.6-1`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.6-3`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.6-4`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.6-5`	vulnerable
Ubuntu	mariadb	26.04	`1:11.8.6-5ubuntu0.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	mariadb	source	sid	`1:11.8.8-1`	not yet assigned	Not reported	Not reported
Debian	mariadb	source	forky	`1:11.8.8-1`	not yet assigned	Not reported	Not reported
Debian	mariadb	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	mariadb	source	bookworm	`1:10.11.18-0+deb12u1`	not yet assigned	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`10.6.26`	Not reported	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`10.11.17`	Not reported	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`11.4.11`	Not reported	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`11.8.7`	Not reported	Not reported	Not reported
Cpe	mariadb	cpe	Not reported	`1:10.11.18-0+deb12u1`	Not reported	Not reported	Not reported
Alpine	mariadb	apk	3.20	`10.11.17-r0`	Not reported	ALPINE-CVE-2026-44168	Not reported
Alpine	mariadb	apk	3.21	`11.4.11-r0`	Not reported	ALPINE-CVE-2026-44168	Not reported
Alpine	mariadb	apk	3.22	`11.4.11-r0`	Not reported	ALPINE-CVE-2026-44168	Not reported
Alpine	mariadb	apk	3.23	`11.4.11-r0`	Not reported	ALPINE-CVE-2026-44168	Not reported
Alpine	mariadb	apk	3.24	`11.8.7-r0`	Not reported	ALPINE-CVE-2026-44168	Not reported
Ubuntu	mariadb	deb	26.04	`1:11.8.6-5ubuntu0.1`	Not reported	UBUNTU-CVE-2026-44168	Not reported

Notes

[trixie] mariadb: Will be fixed via point release

OpenFactory catalog packages

[Debian 13 (Trixie)]

[libmariadb3]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[libmariadbd19t64]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[libmariadbd-dev]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[libmariadb-dev]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[libmariadb-dev-compat]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-backup]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-client]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-client-compat]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · all · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · all · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-client-core]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-common]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · all · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · all · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-plugin-connect]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-plugin-connect-jdbc]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · all · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · all · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-plugin-cracklib-password-check]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-plugin-gssapi-client]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-plugin-gssapi-server]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-plugin-hashicorp-key-management]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-plugin-mroonga]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-plugin-oqgraph]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-plugin-provider-bzip2]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13
[mariadb-plugin-provider-lz4]Interessata
Pacchetto sorgente: [mariadb]
Dettagli (2)
- 1:11.8.6-0+deb13u1 · amd64 · trixie
  Interessata
  nvd · mariadb · debian · 13
- 1:11.8.6-0+deb13u1 · arm64 · trixie
  Interessata
  nvd · mariadb · debian · 13

Altri risultati

Osservato: Oct 23, 2026, 10:02:54 PM UTC

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]