CVE-2026-48165

Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.26 MariaDB server versions 10.11.1 through 10.11.17 MariaDB server versions 11.4.1 through 11.4.11 MariaDB server versions 11.8.1 through 11.8.7 MariaDB server version 12.3.1

Description A high-privileged user can execute shell commands with the privileges of the mariadbd process UID on a Galera joiner node. This is achieved by manipulating the wsrep sst receive address or wsrep sst donor global system variables.

Recommendations Update versions 10.6.1 through 10.6.26 to 10.6.27. Update versions 10.11.1 through 10.11.17 to 10.11.18. Update versions 11.4.1 through 11.4.11 to 11.4.12. Update versions 11.8.1 through 11.8.7 to 11.8.8. Update version 12.3.1 to 12.3.2.