UpHeron
All vulnerabilities

Servers and applications

CVE-2026-48165

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node.…

Severity
High 7.2
Published
12 Jun 2026
Last changed
3 Aug 2026
Added to UpHeron
17 Oct 2026
Fixed in
10.6.27, 10.11.18, 11.4.12, 11.8.8
Sources
NVD

Affected software

SoftwareAffected versions
MariaDBServers and applications · cpe:a:mariadb:mariadb
  • From 10.6.1 before 10.6.27
  • From 10.11.1 before 10.11.18
  • From 11.4.1 before 11.4.12
  • From 11.8.1 before 11.8.8
  • Version 12.3.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-48165
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-48165