CVE-2026-48165: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-48165 is an OS command injection vulnerability in MariaDB Community Server affecting the Galera Cluster replication feature. A high-privileged MariaDB user can manipulate the wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute arbitrary shell commands as the UID of the mariadbd process on the Galera joiner node. Affected versions include 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1. The vulnerability was published on June 12, 2026, and credited to researcher letchu_pkt. It carries a CVSS v3.1 base score of 7.2 (High) per NVD, and 8.0 (High) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where MariaDB's Galera SST (State Snapshot Transfer) subsystem unsafely uses the values of the wsrep_sst_receive_address and wsrep_sst_donor global system variables when constructing shell commands on the joiner node. An attacker with high database privileges (e.g., SUPER or SYSTEM_VARIABLES_ADMIN) can set these variables to inject malicious shell metacharacters or commands, which are then executed by the mariadbd process during a Galera SST operation. The attack vector is network-based, requires no user interaction, but does require high privileges. The issue is tracked upstream as MDEV-39676 (GitHub Advisory, MariaDB JIRA).

Successful exploitation allows a high-privileged MariaDB user to execute arbitrary OS-level shell commands as the mariadbd process user on the Galera joiner node, resulting in full confidentiality, integrity, and availability compromise of that node. This could enable an attacker to read or exfiltrate sensitive database files and OS data, modify or destroy data, disrupt database availability, and potentially pivot to other systems accessible from the database server. The scope change noted in the GitHub advisory (S:C) reflects that the impact extends beyond the database process itself to the underlying operating system (GitHub Advisory, Feedly).

1. Reconnaissance: Identify MariaDB instances running Galera Cluster (wsrep-enabled) on affected versions (10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, or 12.3.1) using network scanning tools or by querying SELECT @@version and SHOW VARIABLES LIKE 'wsrep%' after obtaining database access.
2. Obtain high-privileged credentials: Acquire a MariaDB account with SUPER or SYSTEM_VARIABLES_ADMIN privileges, either through credential theft, brute force, or insider access.
3. Inject malicious value into wsrep variable: Connect to the MariaDB instance and set a malicious value in one of the vulnerable global system variables, for example:

   SET GLOBAL wsrep_sst_receive_address = '127.0.0.1/; <malicious_command> #';

   or similarly for wsrep_sst_donor.
4. Trigger SST operation: Initiate or wait for a Galera State Snapshot Transfer (SST) event on the joiner node (e.g., by restarting a Galera node or causing a node to rejoin the cluster), which causes mariadbd to use the injected variable value in a shell command.
5. Achieve OS command execution: The injected shell command executes as the UID of the mariadbd process on the joiner node, enabling reverse shell establishment, data exfiltration, or further lateral movement (GitHub Advisory, Feedly).

• Logs: MariaDB error log (/var/log/mysql/error.log or /var/lib/mysql/<hostname>.err) showing unexpected shell command output or errors during SST operations; audit log entries showing SET GLOBAL wsrep_sst_receive_address or SET GLOBAL wsrep_sst_donor being modified by non-administrative users.
• Database: Query SHOW GLOBAL VARIABLES LIKE 'wsrep_sst_receive_address' and SHOW GLOBAL VARIABLES LIKE 'wsrep_sst_donor' — values containing shell metacharacters (;, |, &, $(), backticks) are highly suspicious.
• Process: Unexpected child processes spawned by mariadbd (e.g., /bin/sh, bash, curl, wget, nc, python) visible via ps aux or process monitoring tools.
• Network: Unexpected outbound connections from the database server to external IPs, particularly during or shortly after Galera SST events; unusual traffic on non-standard ports originating from the mariadbd process.
• File System: New or modified files in directories writable by the mysql or mariadb OS user, such as web shells, cron jobs, or SSH authorized_keys modifications (GitHub Advisory).

Upgrade MariaDB to one of the patched versions: 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2 (GitHub Advisory, MariaDB Releases). As a workaround where immediate patching is not possible, restrict the SUPER and SYSTEM_VARIABLES_ADMIN privileges to only fully trusted accounts, and monitor or alert on any changes to wsrep_sst_receive_address and wsrep_sst_donor via the MariaDB audit plugin. If Galera Cluster is not in use, consider disabling wsrep entirely (wsrep_on=OFF) to reduce the attack surface.

The vulnerability received coverage from security news outlets including SecurityOnline.info, which noted the CVSS score, and BeyondMachines.net, which highlighted it as a critical command injection flaw in MariaDB Community Server (SecurityOnline, BeyondMachines). The Singapore Cyber Security Agency (CSA) issued an alert (AL-2026-078) referencing the vulnerability (CSA Alert). SUSE and openSUSE issued security update announcements for their MariaDB packages (SUSE Advisory). Social media activity was limited, with brief mentions on Mastodon and Bluesky from security community accounts.