CVE-2026-48165·MariaDB vulnerability
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
- Severity
- high
- Software
- MariaDB
- Fixed in
- 11.8.8
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.52% — higher than 40% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Read the two together. CVE-2026-48165 scores 8 on CVSS, so a successful attack would be serious — but at 0.52%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.
Affected versions
From: 11.8.1
Until: 11.8.8
Fixed in: 11.8.8
How to fix this CVE
MariaDB versions 11.8.1 through 11.8.7 contain a privilege escalation vulnerability in Galera cluster configuration that allows high-privileged users to execute arbitrary shell commands. Upgrade to version 11.8.8 or later immediately to eliminate this risk. If you are running MariaDB in a Galera cluster environment, prioritize this update to prevent unauthorized command execution.
sudo dnf update mariadb-serverDefensia detects this vulnerability
How to check if you are affected
- Check installed MariaDB version: mysql -V or SELECT VERSION(); from the MariaDB shell
- Verify Galera cluster status if enabled: SHOW STATUS LIKE 'wsrep%'; to confirm cluster membership and configuration variables
- Search system logs and MariaDB error logs for suspicious wsrep_sst_receive_address or wsrep_sst_donor variable modifications: grep -r 'wsrep_sst' /var/log/mysql/ /var/log/mariadb/
- Confirm the patch by upgrading and re-running mysql -V to verify the version is 11.8.8 or later
FAQ
What is CVE-2026-48165?
CVE-2026-48165 is a privilege escalation vulnerability in MariaDB's Galera cluster implementation that allows database administrators with high privileges to execute arbitrary shell commands on cluster nodes by manipulating global system variables during state transfer operations.
Is CVE-2026-48165 being actively exploited?
No, there is no evidence of active exploitation in the wild, and no public exploit code is available. However, the vulnerability requires high database privileges, limiting the attack surface to trusted internal actors.
What versions of MariaDB are affected by CVE-2026-48165?
MariaDB versions 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1 are vulnerable. The 11.8.x series is affected from 11.8.1 to 11.8.7.
How do I check if my server is vulnerable to CVE-2026-48165?
Connect to MariaDB and run SELECT VERSION(); to retrieve your version number. If it falls within the affected ranges (11.8.1–11.8.7 for the 11.8 branch), your server is vulnerable.
Does Defensia detect CVE-2026-48165?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If MariaDB is installed on a monitored server, CVE-2026-48165 will appear in your dashboard with remediation steps.
Related MariaDB CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-48165. Free for 1 server.
Get started free