CVE-2026-48165

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv	Vendor Advisory
https://jira.mariadb.org/browse/MDEV-39676	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mariadb:mariadb::::::::
	cpe:2.3:a:mariadb:mariadb::::::::
	cpe:2.3:a:mariadb:mariadb::::::::
	cpe:2.3:a:mariadb:mariadb::::::::
	cpe:2.3:a:mariadb:mariadb:12.3.1:::::::*

History

17 Jun 2026, 10:54

Type	Values Removed	Values Added
References	~~() https://jira.mariadb.org/browse/MDEV-39676 - Third Party Advisory, Issue Tracking~~	() https://jira.mariadb.org/browse/MDEV-39676 - Issue Tracking, Third Party Advisory

16 Jun 2026, 18:58

Type	Values Removed	Values Added
CPE		cpe:2.3:a:mariadb:mariadb:::::::: cpe:2.3:a:mariadb:mariadb:12.3.1:::::::*
References	~~() https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv -~~	() https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv - Vendor Advisory
References	~~() https://jira.mariadb.org/browse/MDEV-39676 -~~	() https://jira.mariadb.org/browse/MDEV-39676 - Third Party Advisory, Issue Tracking
First Time		Mariadb mariadb Mariadb

12 Jun 2026, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-12 18:16

Updated : 2026-06-17 10:54

NVD link : CVE-2026-48165

Mitre link : CVE-2026-48165

CVE.ORG link : CVE-2026-48165

JSON object : View

Products Affected

mariadb

mariadb

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-48165", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48165", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-15T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MariaDB", "product": "server", "versions": [{"status": "affected", "version": ">= 10.6.1, < 10.6.27"}, {"status": "affected", "version": ">= 10.11.1, < 10.11.18"}, {"status": "affected", "version": ">= 11.4.1, < 11.4.12"}, {"status": "affected", "version": ">= 11.8.1, < 11.8.8"}, {"status": "affected", "version": ">= 12.3.1, < 12.3.2"}]}]}], "published": "2026-06-12T18:16:35.177", "references": [{"url": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://jira.mariadb.org/browse/MDEV-39676", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}], "lastModified": "2026-06-17T10:54:54.660", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6026522E-017A-443D-A9FD-1B2EF7EAA831", "versionEndExcluding": "10.6.27", "versionStartIncluding": "10.6.1"}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62E23067-363A-462C-90C0-5A794F39CCB8", "versionEndExcluding": "10.11.18", "versionStartIncluding": "10.11.1"}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA375E93-AD33-44B6-94A4-534B19D25E2E", "versionEndExcluding": "11.4.12", "versionStartIncluding": "11.4.1"}, {"criteria": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70A1D901-D520-41DC-B74B-11C5E27D3CF7", "versionEndExcluding": "11.8.8", "versionStartIncluding": "11.8.1"}, {"criteria": "cpe:2.3:a:mariadb:mariadb:12.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57DFA226-8D97-4A19-8A62-426042F5416D"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}