> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/release-notes/galera-cluster/mysql-wsrep/8.0/8.0.46-26.27.md).

# MySQL-wsrep 8.0.46-26.27 Release Notes

## Changes in MySQL-wsrep 8.0.46-26.27 (2026-05-13)

MariaDB is pleased to announce a new GA release of Galera Cluster for MySQL 8.0, consisting of MySQL-wsrep 8.0.46 and wsrep API version 26.

This release incorporates all changes up to MySQL 8.0.46. MySQL 8.0.46 is the last release of MySQL 8.0 which is now EOL.

Galera Cluster 8.0 is available as targeted packages and package repositories for Debian 11 (Bullseye), and 12 (Bookworm), Ubuntu 22.04 LTS (Jammy), and 24.04 LTS (Noble), RHEL 8, and 9. Obtaining packages using a package repository removes the need to download individual files and facilitates the deployment and upgrade of Galera nodes.

This release is available from: <https://mariadb.com/galera-downloads/>

### Notable changes and fixes in MySQL-wsrep in 8.0.46-26.27:

* Added the `--galera-info` parameter to the `mysqldump` tool to add the wsrep start position to the end of the database dump.
* A parameter-injection gap existed in `wsrep_sst_rsync` because it failed to validate the joiner-supplied `WSREP_SST_OPT_REMOTE_USER` and `WSREP_SST_OPT_REMOTE_PSWD` values before interpolating them into the donor-written `stunnel.conf` and the rsync magic file.
* An appropriately privileged user (with `SUPER` privileges) could execute shell commands as the UID of the `mariadbd` process because the values of the system variables `wsrep_sst_donor` and `wsrep_sst_receive_address`, which can be modified at runtime, were not properly sanitized when used to construct a shell command.
* The `wsrep_notify_cmd` functionality was susceptible to a parameter-injection vulnerability, as it failed to validate the peer-supplied `wsrep_node_name` and `wsrep_node_incoming_address` values before interpolating them into the notification command line.
* An appropriately privileged user (with `SUPER` or `SYSTEM_VARIABLES_ADMIN` privileges) could execute shell commands as the UID of the `mariadbd` process because the values of the system variable `wsrep_sst_auth`, which can be modified at runtime, were not properly sanitized when used to construct a shell command.
* An appropriately privileged user (with `SUPER` or `SYSTEM_VARIABLES_ADMIN` privileges) could execute shell commands as the UID of the `mariadbd` process because the values of the system variable `wsrep_node_address`, which can be modified at runtime, were not properly sanitized when used to construct a shell command.

### Known Issues:

* InnoDB tablespaces outside of the data directory are not supported, as they may not be copied over during SST.

<sub>*This page is: Copyright © 2026 MariaDB. All rights reserved.*</sub>

{% @marketo/form formid="4316" formId="4316" %}