CVE-2026-48165: MariaDB Galera wsrep Command Injection – Patching Guide

Technical summary

CVE-2026-48165 is an OS command injection vulnerability in MariaDB's Galera Replication State Snapshot Transfer (SST) mechanism. The wsrep_sst_receive_address and wsrep_sst_donor global system variables lack proper input validation and sanitization, allowing a database user with high privileges (typically SUPER or administrative role) to inject shell metacharacters that are executed by the mariadbd process during SST operations on joiner nodes. The vulnerability chains database-level access to operating system-level code execution, with the attack surface limited to cluster replication scenarios where a node is joining an existing cluster. Affected versions include 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1 (all without the patch).

Business impact

Organizations running MariaDB in clustered Galera configurations face a privilege escalation risk that extends beyond database boundaries into the operating system. A database administrator with malicious intent or a compromised account with high privileges could gain shell access to database servers, potentially leading to lateral movement, data exfiltration, system compromise, and disruption of services. This is particularly dangerous in multi-tenant or cloud environments where database administrative access may be more broadly distributed. The impact is heightened in containerized or Kubernetes deployments where compromised database pods could be used as footholds for cluster-wide attacks.

Affected systems

MariaDB Server versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 are vulnerable. The issue is specific to Galera-replication deployments and requires the attacker to have high-level database privileges (administrative user role). Systems using MariaDB in standalone configurations without Galera clustering are not affected. Community versions and enterprise distributions shipping affected release lines are in scope.

Exploitability

Exploitation requires that the attacker possess high-level database privileges—a significant gatekeeping factor that prevents external or unauthenticated exploitation. However, the CVSS score of 8.0 reflects the severity once such access is obtained, acknowledging that administrative credentials are not uncommon targets in real-world attack scenarios (credential theft, insider threats, supply chain compromise). The attack is feasible but depends on an established foothold with database privileges and active Galera cluster operations. No public exploit code is known to be available, and this vulnerability has not been added to the CISA KEV catalog.

Remediation

Upgrade affected MariaDB instances to patched versions: 10.6.27 or later, 10.11.18 or later, 11.4.12 or later, 11.8.8 or later, or 12.3.2 or later. Before patching, restrict administrative database privileges to trusted personnel only, monitor for unusual SST variable modifications, and review MariaDB user account permissions across your fleet. Consider implementing OS-level controls (SELinux, AppArmor) to confine the mariadbd process and limit command execution scope as a defense-in-depth measure.

Patch guidance

Patches are available from MariaDB. Version 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2 address the vulnerability. Plan patching around maintenance windows, as it may require cluster quorum changes or rolling restarts in Galera deployments. Test patches in staging environments that mirror your Galera topology to ensure cluster stability and replication health post-upgrade. Verify patch application by confirming the upgraded version matches the advisory and review release notes for any breaking changes or migration guidance specific to your release line.

Detection guidance

Monitor MariaDB audit logs (if enabled) for ALTER GLOBAL VARIABLE or SET commands targeting wsrep_sst_receive_address and wsrep_sst_donor, especially when issued by administrative users outside change-control windows. Watch for shell metacharacters (backticks, pipes, semicolons, ampersands) in system variable values. At the OS level, monitor mariadbd process execution for unexpected child process spawning (shell, script interpreters) and review /proc/<pid>/cmdline for suspicious arguments. Network-level detection is difficult, so application-layer logging and database audit trails are critical. Implement alerting on privilege escalation attempts and unusual administrative database activity.

Why prioritize this

This vulnerability merits immediate attention for organizations running Galera-clustered MariaDB deployments. While it requires high-privilege database access, such access is a realistic attack vector in breach scenarios, insider threats, and supply chain incidents. The ability to escalate from database-level privileges to OS-level command execution significantly amplifies blast radius and persistence options for an attacker. Patching is straightforward and well-scoped, making this a high-ROI remediation effort.

Risk score, explained

CVSS 8.0 (HIGH) reflects the combination of network-exploitable attack surface (Galera clusters exposed on internal networks), high required privileges (limiting the attacker pool), significant impact once achieved (arbitrary command execution, system compromise, confidentiality/integrity/availability impact across cluster boundaries), and complex but achievable attack complexity. The score appropriately penalizes the privilege requirement while crediting the severity of OS-level code execution in a clustered database context. The CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates attack requires high privilege and some complexity, but system scope and impact are critical.

Frequently asked questions