---
cve: "CVE-2026-48165"
severity: "HIGH"
cvss: 8.0
epss: "1.6%"
vendor: "MariaDB"
kev: false
exploited: false
published: "2026-06-12 18:16:35"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-22T18:45:26+02:00"
---

# CVE-2026-48165

> 8.0 HIGH · 🧪 PoC

## Beschreibung

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-08-03 12:05:49
- CNA-CVSS: **8.0** (`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Hoch | good |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-78** — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

## Angriffsmuster (CAPEC)

- [CAPEC-6 — Argument Injection](https://capec.mitre.org/data/definitions/6.html) _(Severity: High)_
- [CAPEC-15 — Command Delimiters](https://capec.mitre.org/data/definitions/15.html) _(Severity: High)_
- [CAPEC-43 — Exploiting Multiple Input Interpretation Layers](https://capec.mitre.org/data/definitions/43.html) _(Severity: High)_
- [CAPEC-88 — OS Command Injection](https://capec.mitre.org/data/definitions/88.html) _(Severity: High)_
- [CAPEC-108 — Command Line Execution through SQL Injection](https://capec.mitre.org/data/definitions/108.html) _(Severity: Very High)_

## Patch verfügbar (OSV)

- b2050fdb4a8776422baf01a41bf86845994edb97 (Commit)
- 197f92bee02d8e836f529f37625be69b83e7acbd (Commit)

## BSI-Hinweise (deutsch)

- [MariaDB: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-1744) — _BSI-Einstufung: hoch_
  Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MariaDB ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

## Referenzen

- <https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv>
- <https://jira.mariadb.org/browse/MDEV-39676>
- <https://access.redhat.com/errata/RHSA-2026:25143>
- <https://access.redhat.com/errata/RHSA-2026:25145>
- <https://access.redhat.com/errata/RHSA-2026:33093>
- <https://access.redhat.com/errata/RHSA-2026:33412>
- <https://access.redhat.com/errata/RHSA-2026:33464>
- <https://access.redhat.com/errata/RHSA-2026:33481>
- <https://access.redhat.com/errata/RHSA-2026:33482>
- <https://access.redhat.com/errata/RHSA-2026:49522>
- <https://access.redhat.com/security/cve/CVE-2026-48165>
- <https://bugzilla.redhat.com/show_bug.cgi?id=2488458>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-48165/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_