VulnSocial

CVE-2026-48163Patch(mariadb / mariadb)

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch mariadb mariadb systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

mariadb CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mariadb

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-06-07); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
mariadb
Products
mariadb

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-06-07: 1Mentions · 2026-06-12: 1Mentions · 2026-06-23: 1Patch / Workaround · 2026-06-07: 1Patch / Workaround · 2026-06-12: 1Technical Details · 2026-06-12: 106-0706-1206-23
Signal classification2 categories
Patch
266.7%
General
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-071
Patch1
2026-06-121
Patch1
2026-06-231
General1
Full discourse3 posts
  • yousukezan@yousukezan
    Patch

    MariaDB Community Serverに複数の脆弱性が見つかり、うち1件はCVSSスコア10.0の最高評価を受けた。 最も深刻な脆弱性は「CVE-2026-49261」で、CVSS基本値は10.0。詳細な技術情報は現時点で公開されていない。 このほか、「CVE-2026-48165」と「CVE-2026-48163」の2件もCVSS 8.0の高リスク脆弱性として報告された。対象となるのはMariaDB Community Server 11.8.8未満、11.4.12未満、10.11.18未満、10.6.27未満の各バージョン。 記事では、これらの問題への対策として、ベンダーが提供する保守アップデートを速やかに適用することを推奨している。また、クエリログを継続的に監視し、不審な管理操作の兆候を早期に検知することも勧めている。 https://securityonline.info/mariadb-security-flaw-cvss-10/

    Post summary

    The article announces high‑severity MariaDB CVEs and focuses on applying vendor patches and monitoring query logs to mitigate the risks.

    08141656317.6K
    14.5K followersView on X
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidades en productos MariaDB ❗ CVE-2026-49261 ❗ CVE-2026-48165 ❗ CVE-2026-48163 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-mariadb/ https://t.co/qNTKkpUtZ3

    Post summary

    The post simply lists MariaDB CVEs and directs readers to external links for more information, with no additional details or claims.

    00011271
    6.7K followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - MariaDB Galera SST Parameter Injection, Donor & Joiner Sides (CVE-2026-48163 & CVE-2026-48165) Two related command-injection flaws in MariaDB's Galera State Snapshot Transfer. In CVE-2026-48163, the rsync SST method on the donor node fails to validate joiner-supplied values like WSREP_SST_OPT_REMOTE_USER/PSWD before writing them into stunnel.conf and the rsync magic file. CVE-2026-48165 is the joiner-side counterpart via unsafe wsrep_sst_receive_address handling. In both cases an attacker positioned in the cluster sync flow can inject and execute arbitrary shell commands. They were patched together and ship alongside the critical wsrep_notify_cmd RCE (CVE-2026-49261, CVSS 10.0) - Galera users should treat the whole batch as one upgrade. 👉Upgrade to MariaDB 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2.

    Post summary

    Two command‑injection flaws were disclosed in MariaDB Galera SST (CVE-2026-48163 & CVE-2026-48165); official patch releases are recommended for affected versions.

    0000057
    216 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appmariadbmariadb---
Appmariadbmariadb12.3.1--

Explore more

Back to dashboardmariadb CVEsmariadb vulnerabilities