mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user

🗓️ 10 Jun 2026 23:13:27Reported by RedHatType

MariaDB lets high-privileged users execute shell commands on Galera joiner via wsrep_sst_receive_address or wsrep_sst_donor.

Reporter	Title	Published	Views	Family All 127
FreeBSD	MariaDB -- Multiple vulnerabilities	28 May 202600:00	–	freebsd
AlpineLinux	CVE-2026-48165	12 Jun 202617:35	–	alpinelinux
BDU FSTEC	The vulnerability of the `wsrep_sst_receive_address` and `wsrep_sst_donor` parameters in the `sql/wsrep_sst.cc` file of the MariaDB database management system allows a hacker to execute arbitrary commands.	21 Sep 202600:00	–	bdu_fstec
Chainguard	CVE-2026-48165 vulnerabilities	16 Sep 202602:54	–	cgr
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: mariadb / mariadb-backup / mariadb-backup-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_33093)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: galera / galera-debuginfo / galera-debugsource / mariadb11.8 / etc Multiple Vulnerabilities (crlsa-2026_33412)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: Judy / Judy-debuginfo / Judy-debugsource / galera / etc Multiple Vulnerabilities (crlsa-2026_33464)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9 [CIQ] Security Update: galera / galera-debuginfo / galera-debugsource / mariadb / etc Multiple Vulnerabilities (crlsa-2026_33481)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9 [CIQ] Security Update: galera / galera-debuginfo / galera-debugsource / mariadb / etc Multiple Vulnerabilities (crlsa-2026_33482)	1 Oct 202600:00	–	nessus
Tenable Nessus	Fedora 44 : mariadb10.11 (2026-0b7d84b1d6)	6 Jul 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	mariadb10.11	10.11.18-1.hum1	mariadb10.11-10.11.18-1.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	mariadb10.11	10.11.18-1.hum1	mariadb10.11-10.11.18-1.hum1.x86_64.rpm
Red Hat Hardened Images	any	noarch	mariadb10.11-client-utils	10.11.18-1.hum1	mariadb10.11-client-utils-10.11.18-1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-48165
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv
jira	www.jira.mariadb.org/browse/MDEV-39676
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-48165
cve	www.cve.org/CVERecord

07 Sep 2026 23:40Current

7.9High risk

Vulners AI Score7.9

CVSS 3.17.2 - 9.1

EPSS0.01602

SSVC