CVE-2026-48165Disclosure(mariadb / mariadb)

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch mariadb mariadb systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

mariadb CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mariadb

Threat summary

Patch or workaround signal is available
5 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 4d ago at 1 mentions (2026-06-07); latest day: 1
5 total mentions across 5 days

Affected systems

Vendors

mariadb

Products

mariadb

1 version affected across 1 product

Deep dive

Activity timeline5 mentions / 5d

Signal classification3 categories

Disclosure

240.0%

Patch

240.0%

General

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-07	1	Disclosure1
2026-06-12	1	Patch1
2026-06-13	1	Patch1
2026-06-23	1	General1
2026-08-07	1	Disclosure1

Full discourse5 posts

yousukezan@yousukezan136d
Disclosure
MariaDB Community Serverに複数の脆弱性が見つかり、うち1件はCVSSスコア10.0の最高評価を受けた。最も深刻な脆弱性は「CVE-2026-49261」で、CVSS基本値は10.0。詳細な技術情報は現時点で公開されていない。このほか、「CVE-2026-48165」と「CVE-2026-48163」の2件もCVSS 8.0の高リスク脆弱性として報告された。対象となるのはMariaDB Community Server 11.8.8未満、11.4.12未満、10.11.18未満、10.6.27未満の各バージョン。記事では、これらの問題への対策として、ベンダーが提供する保守アップデートを速やかに適用することを推奨している。また、クエリログを継続的に監視し、不審な管理操作の兆候を早期に検知することも勧めている。 https://securityonline.info/mariadb-security-flaw-cvss-10/
Post summary
MariaDB Community Server has been found to have multiple high‑severity CVEs, with CVSS 10.0 and 8.0 ratings, and users are urged to apply vendor updates and monitor logs promptly.
08141656317.6K
14.5K followersView on X
CERT-PY@CERTpy121d
General
⚠️ Vulnerabilidades en productos MariaDB ❗ CVE-2026-49261 ❗ CVE-2026-48165 ❗ CVE-2026-48163 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-mariadb/ https://t.co/qNTKkpUtZ3
Post summary
The post lists three MariaDB CVE identifiers and provides a link for additional information, but does not supply substantive details or actionable content.
00011271
6.7K followersView on X
LakshmiKanthan K@LetchuPkt76d
Disclosure
I just published MariaDB CVE-2026–48165: Authenticated Remote Code Execution through WSREP State Snapshot Transfer https://letchupkt.medium.com/mariadb-cve-2026-48165-authenticated-remote-code-execution-through-wsrep-state-snapshot-transfer-f9ce7d68ea1e/share/letchupkt?source=social.tw https://t.co/PCssspK8Ek
Post summary
The author announces the publication of a Medium article detailing MariaDB CVE-2026-48165, focusing on the vulnerability description without providing exploit code, patch information, or evidence of active exploitation.
0001037
7 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters131d
Patch
CVE-2026-48165 - OS Command Injection in MariaDB. High-privileged users can execute shell commands via wsrep_sst variables. CVSS 8.0. Patch released. Update now. #CVE #MariaDB #infosec #CyberSecurity #cvealert More FREE expert portal: https://www.valtersit.com/cve/CVE-2026-48165
Post summary
CVE‑2026‑48165 is an OS Command Injection flaw in MariaDB that allows high‑privileged users to execute shell commands via wsrep_sst variables; a vendor patch has been released and users are urged to update.
0000039
929 followersView on X
Upwind Security MDR@UpwindMDR131d
Patch
🚨High - MariaDB Galera SST Parameter Injection, Donor & Joiner Sides (CVE-2026-48163 & CVE-2026-48165) Two related command-injection flaws in MariaDB's Galera State Snapshot Transfer. In CVE-2026-48163, the rsync SST method on the donor node fails to validate joiner-supplied values like WSREP_SST_OPT_REMOTE_USER/PSWD before writing them into stunnel.conf and the rsync magic file. CVE-2026-48165 is the joiner-side counterpart via unsafe wsrep_sst_receive_address handling. In both cases an attacker positioned in the cluster sync flow can inject and execute arbitrary shell commands. They were patched together and ship alongside the critical wsrep_notify_cmd RCE (CVE-2026-49261, CVSS 10.0) - Galera users should treat the whole batch as one upgrade. 👉Upgrade to MariaDB 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2.
Post summary
The CVE‑2026‑48163/48165 flaws in MariaDB Galera SST allow arbitrary shell command execution; these have been addressed in MariaDB 10.6.27, 10.11.18, 11.4.12, 11.8.8 and 12.3.2, and users are advised to upgrade immediately.
0000057
216 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mariadb	mariadb	-	-	-
App	mariadb	mariadb	12.3.1	-	-

Explore more

Back to dashboard mariadb CVEs mariadb vulnerabilities

What researchers are saying

CVE-2026-48165

yousukezan[verified]@yousukezanDisclosure

MariaDB Community Server has been found to have multiple high‑severity CVEs, with CVSS 10.0 and 8.0 ratings, and users are urged to apply vendor updates and monitor logs promptly.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

CVE‑2026‑48165 is an OS Command Injection flaw in MariaDB that allows high‑privileged users to execute shell commands via wsrep_sst variables; a vendor patch has been released and users are urged to update.

Upwind Security MDR[verified]@UpwindMDRPatch

The CVE‑2026‑48163/48165 flaws in MariaDB Galera SST allow arbitrary shell command execution; these have been addressed in MariaDB 10.6.27, 10.11.18, 11.4.12, 11.8.8 and 12.3.2, and users are advised to upgrade immediately.

CERT-PY@CERTpyGeneral

The post lists three MariaDB CVE identifiers and provides a link for additional information, but does not supply substantive details or actionable content.

LakshmiKanthan K@LetchuPktDisclosure

The author announces the publication of a Medium article detailing MariaDB CVE-2026-48165, focusing on the vulnerability description without providing exploit code, patch information, or evidence of active exploitation.