CVE-2026-48163: MariaDB RST Command Injection – Remote Code Execution on Donor Nodes

Technical summary

CVE-2026-48163 is a command injection vulnerability in MariaDB's State Snapshot Transfer (SST) mechanism via rsync. During SST, the donor node constructs shell commands by interpolating parameters from the joiner without sufficient validation. An attacker with privileges to initiate an SST join can craft malicious parameters that break out of intended command boundaries and execute arbitrary shell commands on the donor node with the privileges of the MariaDB process. The vulnerability exists in versions 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1. Patched versions are 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

Business impact

Compromise of a MariaDB donor node during SST can result in complete database server takeover, unauthorized data access, data modification, and lateral movement into the broader infrastructure. In multi-node cluster deployments, this vulnerability allows an internal or compromised node to execute OS-level commands on production database servers, bypassing database-level access controls. The impact is particularly severe in regulated environments where data integrity and audit trails are required.

Affected systems

MariaDB versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 are vulnerable. The issue is specific to rsync-based SST; other SST methods may not be affected. Organizations running Galera clusters, MariaDB replication, or any multi-node deployment using rsync for state transfer should inventory their versions immediately.

Exploitability

Exploitation requires the attacker to initiate or influence an SST join request, which typically requires administrative credentials or compromised cluster node access. However, the CVSS score reflects that an attacker with high privileges can achieve complete compromise of the donor node (confidentiality, integrity, availability). The attack surface is limited to authenticated cluster participants, but the consequence of compromise is severe. This is not a unauthenticated remote code execution but rather a privilege escalation within a database cluster.

Remediation

Upgrade to patched versions immediately: 10.6.27 or later, 10.11.18 or later, 11.4.12 or later, 11.8.8 or later, or 12.3.2 or later. Before upgrading, restrict SST operations to trusted network segments and disable unnecessary cluster join operations. Apply network-level controls to limit which nodes can initiate SST to the donor. Consider temporarily disabling rsync-based SST in favor of xtrabackup or other validated transfer methods if patching is delayed.

Patch guidance

Verify the exact version of MariaDB running on all nodes using SELECT VERSION();. Cross-reference against the vendor advisory to confirm which versions in your deployment require patching. Test patches in a non-production cluster environment first, as SST operations should be validated before applying to production. Schedule patching during controlled maintenance windows when cluster rebalancing can be managed. After patching, verify that SST operations complete successfully and that no cluster split-brain conditions occur.

Detection guidance

Monitor for unexpected SST initiation events in MariaDB logs and cluster status. Look for rsync processes spawned by the MariaDB user with unusual command-line arguments, particularly those containing shell metacharacters (pipes, semicolons, backticks, variable expansions). Audit cluster join requests and validate that they originate from authorized nodes. Alert on any error messages related to SST parameter validation or shell command execution failures during node joins. Review system call traces (auditd, osquery) for MariaDB process spawning shell interpreters.

Why prioritize this

This is a HIGH severity vulnerability (CVSS 8.0) that enables arbitrary code execution on production database servers within trusted infrastructure. While it requires authenticated cluster access, the compromise scope is complete (confidentiality, integrity, availability across the system boundary). MariaDB clusters often hold critical business data, making this a priority for organizations running Galera deployments or multi-node MariaDB infrastructure. The fact that it is not yet on the CISA KEV list does not diminish its risk; patching should not be delayed pending KEV listing.

Risk score, explained

The CVSS 3.1 score of 8.0 (HIGH) reflects: (1) network-accessible attack vector—nodes communicate over the network; (2) high attack complexity due to requiring cluster access and proper parameter crafting; (3) high privileges required to initiate SST; (4) changed scope because compromise of the donor affects the entire database system and potentially the cluster; (5) high impact on all three pillars—C, I, A—as arbitrary code execution grants complete control. The score appropriately captures that this is a serious internal threat that should be remediated urgently in any multi-node MariaDB environment.

Frequently asked questions