Logo
›
›vulnerability›CVE-2026-48165
Name
CVE-2026-48165
Source
NVD ( link)Debian ( link)
Description
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
CWEs
CWE-78
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwvVendor Advisory
https://jira.mariadb.org/browse/MDEV-39676Issue Tracking

Analysis#

Affected Component
Analysis
mariadb
Exploitable

Vulnerability Ratings#

8
CVSSv31
7.2
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
mariadb
buildroot
master
10.11.17
Exploitable
libmariadb
openwrt
master
3.4.8-r3
Not Affected
mariadb
openwrt
master
11.8.3-r1
Exploitable
libmariadb
openwrt
openwrt-25.12
3.4.8-r3
Not Affected
mariadb
openwrt
openwrt-25.12
11.8.3-r1
Exploitable
mariadb
yocto
kirkstone
10.7.8
Not Affected
mariadb
yocto
master
11.4.12
Not Affected
mariadb
yocto
scarthgap
10.11.16
Exploitable