CVE-2026-48165

EUVD-2026-36520

12.06.2026, 18:16

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

OS Command Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8 HIGH	NETWORK	HIGH	HIGH	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 68%

Affected Products (NVD)

Vendor	Product	Version
mariadb	mariadb	10.6.1 ≤ 𝑥 < 10.6.27
mariadb	mariadb	10.11.1 ≤ 𝑥 < 10.11.18
mariadb	mariadb	11.4.1 ≤ 𝑥 < 11.4.12
mariadb	mariadb	11.8.1 ≤ 𝑥 < 11.8.8
mariadb	mariadb	12.3.1

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Enterprise Linux 10	3:10.11.18-1.el10_2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 10	3:11.8.8-1.el10_2 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8	8100020260616102001.489197e6 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	9080020260612104015.rhel9 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	9080020260612103452.rhel9 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Hardened Images	11.8.8-1.hum1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Hardened Images	10.11.18-1.hum1 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

mariadb

bookworm	1:10.11.18-0+deb12u1 fixed
forky	1:11.8.8-1 fixed
sid	1:11.8.8-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

mariadb

jammy	dne
noble	needs-triage
questing	ignored
resolute	Fixed 1:11.8.6-5ubuntu0.1 released

mariadb-10.0

jammy	dne
noble	dne
questing	dne
resolute	dne

mariadb-10.1

bionic	needs-triage
jammy	dne
noble	dne
questing	dne
resolute	dne

mariadb-10.3

focal	needs-triage
jammy	dne
noble	dne
questing	dne
resolute	dne

mariadb-10.6

jammy	needs-triage
noble	dne
questing	dne
resolute	dne

openSUSE / SLES Releases

openSUSE Product

Release

libmariadbd-devel

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

libmariadbd19

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb-client

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb-errormessages

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

mariadb-tools

suse enterprise sap 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise sap 15 SP7	11.8.8-150700.3.15.1 fixed
suse enterprise server 15 SP4	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP5	10.6.27-150400.3.46.1 fixed
suse enterprise server 15 SP6	10.11.18-150600.4.20.1 fixed
suse enterprise server 15 SP7	11.8.8-150700.3.15.1 fixed

Common Weakness Enumeration

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References

https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv

https://jira.mariadb.org/browse/MDEV-39676

https://access.redhat.com/errata/RHSA-2026:25143

https://access.redhat.com/errata/RHSA-2026:25145

https://access.redhat.com/errata/RHSA-2026:33093

https://access.redhat.com/errata/RHSA-2026:33412

https://access.redhat.com/errata/RHSA-2026:33464

https://access.redhat.com/errata/RHSA-2026:33481

https://access.redhat.com/errata/RHSA-2026:33482

https://access.redhat.com/security/cve/CVE-2026-48165

https://bugzilla.redhat.com/show_bug.cgi?id=2488458

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json