CVE-2026-48165: MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side

Synopsis

This is an authenticated remote code execution vulnerability in MariaDB server, affecting Galera cluster deployments across versions 10.6.1 through 12.3.1 (see affected ranges). A high-privileged MariaDB user can set the wsrep_sst_receive_address or wsrep_sst_donor global system variables to values that cause the server process to execute arbitrary shell commands, running as the OS user of the mariadbd process on the Galera joiner node. Successful exploitation gives an attacker full control over the host process, including reads, writes, and the ability to crash or hijack the database service. Although the description references patched versions (10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2), no fix versions have been formally published in the CVE record yet; HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment upstream confirms availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MariaDB service over the network to issue the malicious variable-set commands.

• AuthenticationRequired

  A high-privileged (admin-level) MariaDB account is needed to set the wsrep_sst_receive_address or wsrep_sst_donor global system variables.

• Victim interactionNot required

  No user interaction is needed; the attacker acts entirely through their own authenticated session.

• Attack complexityDetail

  Attack complexity is rated HIGH, meaning the attacker must account for environmental factors or timing conditions beyond simply sending a request; exploitation is not trivially repeatable without controlling those conditions.

Blast Radius

• The attacker executes arbitrary shell commands as the OS user running the mariadbd process, gaining a foothold on the underlying host.
• Full confidentiality impact: the attacker reads any file accessible to the mariadbd process, including database data files, configuration, and credentials stored on disk.
• Full integrity impact: the attacker writes or modifies files and database contents accessible to the mariadbd process, including persisted table data and server configuration.
• Full availability impact: the attacker can crash, disable, or hijack the database service, causing a complete loss of database availability for dependent applications.