p PatchFirst

CVE-2026-48165

CVE-2026-48165 · MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

This page contains facts from public vulnerability sources. Check the original advisory before updating.

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

CVSS 8.0 · High · EPSS 1.6% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • server

    Versions
    • >= 10.6.1, < 10.6.27: Affected
    • >= 10.11.1, < 10.11.18: Affected
    • >= 11.4.1, < 11.4.12: Affected
    • >= 11.8.1, < 11.8.8: Affected
    • >= 12.3.1, < 12.3.2: Affected

    No fix published

  • mariadb Debian:12

    Versions
    • 1:10.11.11-0+deb12u1
    • 1:10.11.13-0+deb12u1
    • 1:10.11.14-0+deb12u1
    • 1:10.11.14-0+deb12u2
    • 1:10.11.3-1
    • 1:10.11.3-2~exp1
    • 1:10.11.4-1
    • 1:10.11.4-1~deb12u1
    • 1:10.11.5-1
    • 1:10.11.5-2
    • 1:10.11.5-3
    • 1:10.11.6-0+deb12u1
    • 1:10.11.6-1
    • 1:10.11.6-2
    • 1:10.11.6-2.1~exp1
    • 1:10.11.7-1
    • 1:10.11.7-2
    • 1:10.11.7-3
    • 1:10.11.7-4
    • 1:10.11.8-1
    • 1:10.11.9-0+deb12u1
    Affected ranges
    • ECOSYSTEM: < 1:10.11.18-0+deb12u1

    Update to 1:10.11.18-0+deb12u1

  • mariadb Debian:13

    Versions
    • 1:11.8.2-1
    • 1:11.8.3-0+deb13u1
    • 1:11.8.3-1
    • 1:11.8.5-1
    • 1:11.8.5-2
    • 1:11.8.5-3
    • 1:11.8.5-3~exp1
    • 1:11.8.5-3~exp2
    • 1:11.8.5-3~exp3
    • 1:11.8.5-4
    • 1:11.8.6-0+deb13u1
    • 1:11.8.6-1
    • 1:11.8.6-2
    • 1:11.8.6-3
    • 1:11.8.6-4
    • 1:11.8.6-5
    • 1:11.8.6-6
    • 1:11.8.8-0+deb13u1
    • 1:11.8.8-1
    • 1:11.8.9+ds-1
    • 1:11.8.9+ds-2
    • 1:11.8.9+ds-3
    • 1:11.8.9+ds-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb Debian:14

    Versions
    • 1:11.8.2-1
    • 1:11.8.3-1
    • 1:11.8.5-1
    • 1:11.8.5-2
    • 1:11.8.5-3
    • 1:11.8.5-3~exp1
    • 1:11.8.5-3~exp2
    • 1:11.8.5-3~exp3
    • 1:11.8.5-4
    • 1:11.8.6-1
    • 1:11.8.6-2
    • 1:11.8.6-3
    • 1:11.8.6-4
    • 1:11.8.6-5
    • 1:11.8.6-6
    Affected ranges
    • ECOSYSTEM: < 1:11.8.8-1

    Update to 1:11.8.8-1

  • mariadb-10.0 Ubuntu:16.04:LTS

    Versions
    • 10.0.20-0ubuntu0.15.04.1
    • 10.0.22-0ubuntu1
    • 10.0.23-1
    • 10.0.23-2
    • 10.0.24-7
    • 10.0.25-0ubuntu0.16.04.1
    • 10.0.27-0ubuntu0.16.04.1
    • 10.0.28-0ubuntu0.16.04.1
    • 10.0.29-0ubuntu0.16.04.1
    • 10.0.31-0ubuntu0.16.04.2
    • 10.0.33-0ubuntu0.16.04.1
    • 10.0.34-0ubuntu0.16.04.1
    • 10.0.36-0ubuntu0.16.04.1
    • 10.0.38-0ubuntu0.16.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb-10.1 Ubuntu:18.04:LTS

    Versions
    • 10.1.25-1
    • 1:10.1.29-6
    • 1:10.1.34-0ubuntu0.18.04.1
    • 1:10.1.38-0ubuntu0.18.04.1
    • 1:10.1.38-0ubuntu0.18.04.2
    • 1:10.1.40-0ubuntu0.18.04.1
    • 1:10.1.41-0ubuntu0.18.04.1
    • 1:10.1.43-0ubuntu0.18.04.1
    • 1:10.1.44-0ubuntu0.18.04.1
    • 1:10.1.47-0ubuntu0.18.04.1
    • 1:10.1.48-0ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb-10.3 Ubuntu:20.04:LTS

    Versions
    • 1:10.3.17-1
    • 1:10.3.18-1
    • 1:10.3.19-1
    • 1:10.3.21-2
    • 1:10.3.22-1
    • 1:10.3.22-1ubuntu1
    • 1:10.3.25-0ubuntu0.20.04.1
    • 1:10.3.29-0ubuntu0.20.04.1
    • 1:10.3.30-0ubuntu0.20.04.1
    • 1:10.3.31-0ubuntu0.20.04.1
    • 1:10.3.32-0ubuntu0.20.04.1
    • 1:10.3.34-0ubuntu0.20.04.1
    • 1:10.3.37-0ubuntu0.20.04.1
    • 1:10.3.38-0ubuntu0.20.04.1
    • 1:10.3.39-0ubuntu0.20.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb-10.6 Ubuntu:22.04:LTS

    Versions
    • 1:10.6.7-2ubuntu1
    • 1:10.6.7-2ubuntu1.1
    • 1:10.6.11-0ubuntu0.22.04.1
    • 1:10.6.12-0ubuntu0.22.04.1
    • 1:10.6.16-0ubuntu0.22.04.1
    • 1:10.6.18-0ubuntu0.22.04.1
    • 1:10.6.21-0ubuntu0.22.04.2
    • 1:10.6.22-0ubuntu0.22.04.1
    • 1:10.6.23-0ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb Ubuntu:24.04:LTS

    Versions
    • 1:10.11.4-1
    • 1:10.11.5-3
    • 1:10.11.6-1
    • 1:10.11.6-2
    • 1:10.11.7-2ubuntu1
    • 1:10.11.7-2ubuntu2
    • 1:10.11.8-0ubuntu0.24.04.1
    • 1:10.11.11-0ubuntu0.24.04.2
    • 1:10.11.13-0ubuntu0.24.04.1
    • 1:10.11.14-0ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb Ubuntu:25.10

    Versions
    • 1:11.4.5-1
    • 1:11.8.1-4
    • 1:11.8.1-5ubuntu2
    • 1:11.8.2-1ubuntu1
    • 1:11.8.3-1
    • 1:11.8.3-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mariadb Ubuntu:26.04:LTS

    Versions
    • 1:11.8.3-1build1
    • 1:11.8.5-1
    • 1:11.8.5-2
    • 1:11.8.5-3
    • 1:11.8.5-4
    • 1:11.8.6-1
    • 1:11.8.6-3
    • 1:11.8.6-4
    • 1:11.8.6-5
    Affected ranges
    • ECOSYSTEM: < 1:11.8.6-5ubuntu0.1

    Update to 1:11.8.6-5ubuntu0.1

Original sources

Check your server →