diff --git a/doc/release-notes-36048.md b/doc/release-notes-36048.md
new file mode 100644
index 00000000000..dc912207707
--- /dev/null
+++ b/doc/release-notes-36048.md
@@ -0,0 +1,8 @@
+Wallet
+------
+
+* On non-Windows systems, an authenticated RPC caller allowed to create wallets
+  could execute arbitrary commands as the node process account when
+  `-walletnotify` was configured, by crafting a wallet name with regex
+  replacement characters. Wallet notification placeholder replacement now
+  treats wallet names literally. (#36048)