Maple Labs

CVE search · CVE-2026-48165

CVE-2026-48165

high 7.2

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
security-advisories@github.com
Weakness
CWE-78

Severity

VersionScoreVectorSource
CVSS 3.1 high 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H security-advisories@github.comSecondary
CVSS 3.1 high 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H nvd@nist.govPrimary
CVSS 3.1 critical 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H 0b0ca135-0b70-47e7-9f44-1890c2a1c46cSecondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References