CVE-2026-48165

MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

HIGH

7.2

CVSS Score

Published: June 12, 2026 at 05:35 PM UTC

Updated: October 26, 2026 at 11:10 AM UTC

1 product affected across 1 vendorMariaDB

Using server by MariaDB?

Get instant alerts when new vulnerabilities affect server - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.2

Exploit prediction

EPSS 2%

SSVC

No known exploit

Description

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

MariaDB · Mariadbnpm

95%

10.11.1 ≤ v < 10.11.1810.6.1 ≤ v < 10.6.2711.4.1 ≤ v < 11.4.1211.8.1 ≤ v < 11.8.812.3.1

Affected range stops below 10.11.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 10.6.27, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.4.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.8.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.3.2, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv

References (13)

x_refsource_CONFIRMVendor Advisory

Source: cverecord

https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv

x_refsource_MISCIssue TrackingThird Party Advisory

Source: cverecord

https://jira.mariadb.org/browse/MDEV-39676