MySQL-wsrep 8.4.11-26.28 Release Notes

Release notes for MySQL-wsrep 8.4.11-26.28, the Q3 2026 LTS release of Galera Cluster for MySQL 8.4.

Changes in MySQL-wsrep 8.4.11-26.28 (2026-08-18)

MariaDB is pleased to announce an LTS release of Galera Cluster for MySQL 8.4, consisting of MySQL-wsrep 8.4.11 and wsrep API version 26.

This release incorporates all changes up to MySQL 8.4.11.

Galera Cluster 8.4 is available as targeted packages and package repositories for Debian 11 (Bullseye), and 12 (Bookworm), Ubuntu 22.04 LTS (Jammy), and Ubuntu 24.04 LTS (Noble), RHEL 8, and 9. Obtaining packages using a package repository removes the need to download individual files and facilitates the deployment and upgrade of Galera nodes.

This release will be available from https://mariadb.com/galera-downloads/.

Notable changes and fixes in MySQL-wsrep in 8.4.11-26.28:

• Added the --galera-info parameter to the mysqldump tool to add the wsrep start position to the end of a database dump.

• A parameter-injection gap existed in wsrep_sst_rsync because it failed to validate the joiner-supplied WSREP_SST_OPT_REMOTE_USER and WSREP_SST_OPT_REMOTE_PSWD values before interpolating them into the donor-written stunnel.conf and the rsync magic file.

• An appropriately privileged user (with SUPER privileges) could execute shell commands as the UID of the mysqld process because the values of the system variables wsrep_sst_donor and wsrep_sst_receive_address, which can be modified at runtime, were not properly sanitized when used to construct a shell command.

• The wsrep_notify_cmd functionality was susceptible to a parameter-injection vulnerability, as it failed to validate the peer-supplied wsrep_node_name and wsrep_node_incoming_address values before interpolating them into the notification command line.

• An appropriately privileged user (with SUPER or SYSTEM_VARIABLES_ADMIN privileges) could execute shell commands as the UID of the mysqld process because the values of the system variable wsrep_sst_auth, which can be modified at runtime, were not properly sanitized when used to construct a shell command.

• An appropriately privileged user (with SUPER or SYSTEM_VARIABLES_ADMIN privileges) could execute shell commands as the UID of the mysqld process because the values of the system variable wsrep_node_address, which can be modified at runtime, were not properly sanitized when used to construct a shell command.

Known Issues:

• InnoDB tablespaces outside of the data directory are not supported, as they may not be copied over during SST.

_{This page is: Copyright © 2026 MariaDB. All rights reserved.}