PT-2026-46037 · Mariadb Foundation+1 · Mariadb+1

CVE-2026-48163 · Published 2026-06-02 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.26 MariaDB server versions 10.11.1 through 10.11.17 MariaDB server versions 11.4.1 through 11.4.11 MariaDB server versions 11.8.1 through 11.8.7 MariaDB server version 12.3.1

Description During the State Snapshot Transfer (SST), the donor node interpolates parameters sent by the joiner into the command line. Due to improper validation of these parameters, a malicious joiner can execute arbitrary shell commands on the donor side when using the rsync SST method.

Recommendations Update versions 10.6.1 through 10.6.26 to 10.6.27 Update versions 10.11.1 through 10.11.17 to 10.11.18 Update versions 11.4.1 through 11.4.11 to 11.4.12 Update versions 11.8.1 through 11.8.7 to 11.8.8 Update version 12.3.1 to 12.3.2

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BIT-MARIADB-2026-48163

BIT-MARIADB-MIN-2026-48163

BIT-MYSQL-CLIENT-2026-48163

CVE-2026-48163

ECHO-671C-EC09-810B

GHSA-RPGV-Q6GV-684R

OPENSUSE-SU-2026:10934-1

OPENSUSE-SU-2026:20933-1

RHSA-2026:25143

RHSA-2026:25145

RHSA-2026:33412

RHSA-2026:33464

RHSA-2026:33481

RHSA-2026:33482

SUSE-SU-2026:22095-1

SUSE-SU-2026:2282-1

SUSE-SU-2026:2284-1

SUSE-SU-2026:2330-1

USN-8536-1

Affected Products

Mariadb

Rocky Linux

References · 75

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48163.json · Exploit
• https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:33481 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-49261 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22095-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:33481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48163 · Security Note
• https://osv.dev/vulnerability/USN-8536-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2330-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mysql-client-2026-48163 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44168 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44173 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25145 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20933-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:33482 · Vendor Advisory