PT-2026-46038 · Mariadb Foundation+1 · Mariadb+1

Osidb Bzimport

·

CVE-2026-48165

·

Published

2026-06-02

·

Updated

2026-07-14

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.26 MariaDB server versions 10.11.1 through 10.11.17 MariaDB server versions 11.4.1 through 11.4.11 MariaDB server versions 11.8.1 through 11.8.7 MariaDB server version 12.3.1
Description A high-privileged user can execute shell commands with the privileges of the mariadbd process UID on a Galera joiner node. This is achieved by manipulating the wsrep sst receive address or wsrep sst donor global system variables.
Recommendations Update versions 10.6.1 through 10.6.26 to 10.6.27. Update versions 10.11.1 through 10.11.17 to 10.11.18. Update versions 11.4.1 through 11.4.11 to 11.4.12. Update versions 11.8.1 through 11.8.7 to 11.8.8. Update version 12.3.1 to 12.3.2.

Exploit

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

BIT-MARIADB-2026-48165
BIT-MARIADB-MIN-2026-48165
BIT-MYSQL-CLIENT-2026-48165
CVE-2026-48165
ECHO-1EED-AC34-46F2
GHSA-7V3P-H23X-8HWV
OPENSUSE-SU-2026:10934-1
OPENSUSE-SU-2026:20933-1
RHSA-2026:25143
RHSA-2026:25145
RHSA-2026:33412
RHSA-2026:33464
RHSA-2026:33481
RHSA-2026:33482
SUSE-SU-2026:22095-1
SUSE-SU-2026:2282-1
SUSE-SU-2026:2284-1
SUSE-SU-2026:2330-1
USN-8536-1

Affected Products

Mariadb
Rocky Linux