CVE-2026-48163: MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)

Synopsis

This is a command injection vulnerability in MariaDB server affecting the rsync-based SST (State Snapshot Transfer) mechanism used during Galera cluster node synchronization. An attacker controlling a joiner node can send crafted, insufficiently validated parameters that the donor node interpolates directly into a shell command line, allowing arbitrary shell command execution on the donor. Successful exploitation gives the attacker full control over the donor node, including read/write access to all database data and the ability to disrupt service. No fix versions have been published upstream yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MariaDB Galera cluster replication port over the network to act as a joiner node presenting malicious SST parameters to the donor.

• AuthenticationRequired

  The attacker must hold admin or privileged cluster credentials sufficient to participate in Galera SST negotiation as a joiner node.

• Victim interactionNot required

  No human interaction is needed; the donor processes the joiner's SST parameters automatically as part of the cluster synchronization flow.

• Attack complexityDetail

  Exploitation requires the attacker to control or impersonate a joiner node and craft specific SST parameters, introducing environmental setup complexity beyond a simple one-step request.

Blast Radius

• Executes arbitrary shell commands on the donor MariaDB node with the privileges of the database process, giving full control over that host.
• Reads all data stored in the donor's databases, including tables, credentials, and any files accessible to the MariaDB process user.
• Modifies or deletes persisted database rows and files on the donor node.
• Crashes or permanently disables the donor node, breaking Galera cluster replication and disrupting database availability for dependent workloads.