Back to search

MariaDB

MariaDB

See the latest tracked release, confirm when it was published, and subscribe for update emails.

12.3 (LTS) Switch to this train 12.2 EOL Switch to this train 11.8 (LTS) Switch to this train 11.4 (LTS) Switch to this train 10.11 (LTS) Current train 10.6 (LTS) EOL Switch to this train
Current version
Last checked: 2026-09-04

10.11.19

Release date
August 24, 2026
Security status
4 high-severity CVEs tracked in the last 90 days. Current version not affected.

Source

endoflife.date

Public release notes are linked for the latest stored release.

View release notes Subscribe to updates

Release history

See the latest published releases stored for this product.

Version Published Notes
10.11.19 2026-08-24 Release Notes
10.11.18 2026-05-27 Release Notes
10.11.17 2026-05-14 Release Notes
10.11.16 2026-02-04 Release Notes

Vulnerability tracking

versionPing monitors CVEs for this product. Matching CVEs are listed below. We only display CVEs with a CVSS score of 7.0 or higher that were published within the last 90 days.

Affected status is inferred from published affected version ranges where available. Always verify against the vendor advisory before making production decisions.

CVE Severity Published Status Summary
CVE-2026-48165 HIGH (8.0) 2026-06-12 Current versionnot affected

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

Affected versions
  • >= 10.6.1, < 10.6.27
  • >= 10.11.1, < 10.11.18
Show 3 more
  • >= 11.4.1, < 11.4.12
  • >= 11.8.1, < 11.8.8
  • >= 12.3.1, < 12.3.2
CVE-2026-48163 HIGH (8.0) 2026-06-12 Current versionnot affected

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

Affected versions
  • >= 10.6.1, < 10.6.27
  • >= 10.11.1, < 10.11.18
Show 3 more
  • >= 11.4.1, < 11.4.12
  • >= 11.8.1, < 11.8.8
  • >= 12.3.1, < 12.3.2
CVE-2026-44168 HIGH (8.0) 2026-06-12 Current versionnot affected

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Affected versions
  • >= 10.6.1, < 10.6.26
  • >= 10.11.1, < 10.11.17
Show 3 more
  • >= 11.4.1, < 11.4.11
  • >= 11.8.1, < 11.8.7
  • >= 12.3.1, < 12.3.2
CVE-2026-49261 CRITICAL (10.0) 2026-06-11 Current versionnot affected

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

Affected versions
  • >= 10.6.1, < 10.6.27
  • >= 10.11.1, < 10.11.18
Show 3 more
  • >= 11.4.1, < 11.4.12
  • >= 11.8.1, < 11.8.8
  • = 12.3.1