CVE-2026-48772

Name of the Vulnerable Software and Affected Versions ProxySQL versions 2.0.0 through 3.0.8

Description The MySQL frontend incorrectly processes the PROXY UNKNOWN <addr> <addr> <port> <port>r PP1 frame of the PROXY protocol v1. According to the specification, when the protocol token is UNKNOWN, the receiver must ignore subsequent address fields. However, the software parses these fields using sscanf and writes the spoofed source address into the session's addr.addr field. This value is then used by the client addr predicate in the query-rule matcher to determine routing and Access Control Lists (ACL). When the mysql-proxy protocol networks variable is set to * (the default setting), any TCP peer can send a PP1 frame to forge a source IP address. This allows an attacker to bypass routing and ACL rules, potentially gaining unauthorized access to routes intended for internal applications or administrative CIDRs, such as read-write splitting or DDL permissions.

Recommendations Update to version 3.0.9.