CVE-2021-27928Wsrep OS Command Injection
mariadb-10.1 - security update
Published Aug 9, 2021 · Updated Sep 8, 2026 · Also known as ALPINE-CVE-2021-27928, BIT-mariadb-2021-27928, BIT-mariadb-min-2021-27928, BIT-mysql-client-2021-27928, DEBIAN-CVE-2021-27928, DLA-2605-1, TR-21-0247, UBUNTU-CVE-2021-27928
Key Facts
Patch immediately- CVE-2021-27928 is a high-severity vulnerability (CVSS 7.2 v3.1) affecting Wsrep (Galeracluster), Mariadb, Percona Server and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 38% probability of exploitation in the next 30 days.
- Fixed versions are available, including asio 1.10.8-7.module_el8.6.0+2867+72759d2f, asio-devel 1.10.8-7.module+el8.1.0+5402+691bd77e, galera 25.3.32-1.module_el8.3.0+2177+7adc332a.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
38%
Higher than 98.5% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
47/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
2
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryhttps://security.alpinelinux.org/vuln/CVE-2021-27928
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2021-27928
- advisoryhttps://ubuntu.com/security/CVE-2021-27928
- advisoryhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-27928
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2021-27928
- advisoryRHSA-2021:1039
Description
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
Affected Products
305 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| WsrepGaleracluster | See advisory | 2021-03-03 |
| MariadbMariadb | >= 10.2.0 | 10.2.37 |
| Percona ServerPercona | See advisory | 2021-03-03 |
| Debian LinuxDebian | 9.0 | n/a |
| mariadb-minbitnami | >= 10.2.0 | 10.2.37 |
Patched Releases
asio
1.10.8-7.module_el8.6.0+2867+72759d2f
asio-devel
1.10.8-7.module+el8.1.0+5402+691bd77e
galera
25.3.32-1.module_el8.3.0+2177+7adc332a, 25.3.32-1.module+el8.3.0+20131+15c9d707, 25.3.32-1.module+el8.4.0+427+adf35707, 10.2.39-3.36.1, 10.4.20-3.9.1, 10.6.5-3.1
Wsrep
<=2021-03-03
Judy
1.0.5-18.0.1.module+el8.3.0+9616+7a81225f, 1.0.5-18.module_el8.6.0+2867+72759d2f, 1.0.5-18.module+el8.4.0+427+adf35707
Judy-devel
1.0.5-18.0.1.module+el8.3.0+9616+7a81225f
liblz4-1
1.8.0-3.5.2
libmariadb_plugins
3.1.22-2.35.1
libmariadb-devel
3.1.22-2.35.1
libmariadb3
3.1.22-2.35.1
libmariadbd-devel
10.4.20-3.9.1, 10.5.11-3.3.1, 10.6.5-3.1
libmariadbd104-devel
10.4.30-150100.3.5.10, 10.4.30-8.5.46
libmariadbd19
10.4.20-3.9.1, 10.4.30-150100.3.5.10, 10.4.30-8.5.46, 10.5.11-3.3.1, 10.6.5-3.1
libmysqld-devel
10.2.39-3.40.1
libmysqld19
10.2.39-3.40.1
lz4
1.8.0-3.5.2
Mariadb
10.2.37, 10.2.38-1.ph1, 10.2.38-1.ph2, 10.2.39-3.36.1, 10.2.39-3.40.1, 10.3.28, 10.3.28-1, 10.3.28-r0, 10.3.29-1.ph3, 10.4.18, 10.4.18-r0, 10.4.20-3.9.1, 10.5.11-3.3.1, 10.5.9, 10.5.9-r0, 10.6.5-3.1, 3:10.1.20-3.el7ost, 3:10.3.28-1.module_el8.3.0+2177+7adc332a, 3:10.3.28-1.module+el8.3.0+20131+15c9d707, 3:10.3.28-1.module+el8.4.0+427+adf35707
mariadb-10.1
10.1.48-0+deb9u2
mariadb-10.5
1:10.5.9-1
mariadb-backup
3:10.3.28-1.module+el8.3.0+20131+15c9d707
mariadb-bench
10.5.11-3.3.1, 10.6.5-3.1
mariadb-client
10.2.39-3.36.1, 10.2.39-3.40.1, 10.4.20-3.9.1, 10.5.11-3.3.1, 10.6.5-3.1
mariadb-common
3:10.3.28-1.module+el8.3.0+20131+15c9d707
mariadb-connector-c
3.1.22-2.35.1
mariadb-devel
3:10.3.28-1.module+el8.3.0+20131+15c9d707
Timeline
Publicly disclosed
Aug 9, 2021
Last updated
Sep 8, 2026
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-94 Improper Control of Generation of Code ('Code Injection')
- CWE-426 Untrusted Search Path
References
- advisorysecurity.alpinelinux.org · CVE-2021-27928
- advisorysecurity-tracker.debian.org · CVE-2021-27928
- advisoryubuntu.com · CVE-2021-27928
- advisoryweb.nvd.nist.gov · vuln
- advisorycve.org · CVERecord
FAQ
Common Questions.
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL.
Affected: Wsrep (Galeracluster); Mariadb versions >= 10.2.0; Percona Server, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including asio 1.10.8-7.module_el8.6.0+2867+72759d2f, asio-devel 1.10.8-7.module+el8.1.0+5402+691bd77e, galera 25.3.32-1.module_el8.3.0+2177+7adc332a.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2021-27928 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo