UnratedFix available

DEBIAN-CVE-2026-48165

Type: advisorySource: OSV1 source record

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

Announced 12 Jun 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-48165

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-48165

mariadb

Source reference: /affected/0/package/name

Affected versions: 1:10.11.11-0+deb12u1
Source reference: /affected/0/versions
1:10.11.13-0+deb12u1
Source reference: /affected/0/versions
1:10.11.14-0+deb12u1
Source reference: /affected/0/versions
1:10.11.14-0+deb12u2
Source reference: /affected/0/versions
1:10.11.3-1
Source reference: /affected/0/versions
1:10.11.3-2~exp1
Source reference: /affected/0/versions
1:10.11.4-1
Source reference: /affected/0/versions
1:10.11.4-1~deb12u1
Source reference: /affected/0/versions
1:10.11.5-1
Source reference: /affected/0/versions
1:10.11.5-2
Source reference: /affected/0/versions
1:10.11.5-3
Source reference: /affected/0/versions
1:10.11.6-0+deb12u1
Source reference: /affected/0/versions
1:10.11.6-1
Source reference: /affected/0/versions
1:10.11.6-2
Source reference: /affected/0/versions
1:10.11.6-2.1~exp1
Source reference: /affected/0/versions
1:10.11.7-1
Source reference: /affected/0/versions
1:10.11.7-2
Source reference: /affected/0/versions
1:10.11.7-3
Source reference: /affected/0/versions
1:10.11.7-4
Source reference: /affected/0/versions
1:10.11.8-1
Source reference: /affected/0/versions
1:10.11.9-0+deb12u1
Source reference: /affected/0/versions
Fixed versions: 1:10.11.18-0+deb12u1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

mariadb

Source reference: /affected/1/package/name

Affected versions: 1:11.8.2-1
Source reference: /affected/1/versions
1:11.8.3-0+deb13u1
Source reference: /affected/1/versions
1:11.8.3-1
Source reference: /affected/1/versions
1:11.8.5-1
Source reference: /affected/1/versions
1:11.8.5-2
Source reference: /affected/1/versions
1:11.8.5-3
Source reference: /affected/1/versions
1:11.8.5-3~exp1
Source reference: /affected/1/versions
1:11.8.5-3~exp2
Source reference: /affected/1/versions
1:11.8.5-3~exp3
Source reference: /affected/1/versions
1:11.8.5-4
Source reference: /affected/1/versions
1:11.8.6-0+deb13u1
Source reference: /affected/1/versions
1:11.8.6-1
Source reference: /affected/1/versions
1:11.8.6-2
Source reference: /affected/1/versions
1:11.8.6-3
Source reference: /affected/1/versions
1:11.8.6-4
Source reference: /affected/1/versions
1:11.8.6-5
Source reference: /affected/1/versions
1:11.8.6-6
Source reference: /affected/1/versions
1:11.8.8-0+deb13u1
Source reference: /affected/1/versions
1:11.8.8-1
Source reference: /affected/1/versions
1:11.8.9+ds-1
Source reference: /affected/1/versions
1:11.8.9+ds-2
Source reference: /affected/1/versions
1:11.8.9+ds-3
Source reference: /affected/1/versions
1:11.8.9+ds-4
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

mariadb

Source reference: /affected/2/package/name

Affected versions: 1:11.8.2-1
Source reference: /affected/2/versions
1:11.8.3-1
Source reference: /affected/2/versions
1:11.8.5-1
Source reference: /affected/2/versions
1:11.8.5-2
Source reference: /affected/2/versions
1:11.8.5-3
Source reference: /affected/2/versions
1:11.8.5-3~exp1
Source reference: /affected/2/versions
1:11.8.5-3~exp2
Source reference: /affected/2/versions
1:11.8.5-3~exp3
Source reference: /affected/2/versions
1:11.8.5-4
Source reference: /affected/2/versions
1:11.8.6-1
Source reference: /affected/2/versions
1:11.8.6-2
Source reference: /affected/2/versions
1:11.8.6-3
Source reference: /affected/2/versions
1:11.8.6-4
Source reference: /affected/2/versions
1:11.8.6-5
Source reference: /affected/2/versions
1:11.8.6-6
Source reference: /affected/2/versions
Fixed versions: 1:11.8.8-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:10.11.18-0+deb12u1"
          }
        ]
      }
    ],
    "package": {
      "name": "mariadb",
      "purl": "pkg:deb/debian/mariadb?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1:10.11.11-0+deb12u1",
      "1:10.11.13-0+deb12u1",
      "1:10.11.14-0+deb12u1",
      "1:10.11.14-0+deb12u2",
      "1:10.11.3-1",
      "1:10.11.3-2~exp1",
      "1:10.11.4-1",
      "1:10.11.4-1~deb12u1",
      "1:10.11.5-1",
      "1:10.11.5-2",
      "1:10.11.5-3",
      "1:10.11.6-0+deb12u1",
      "1:10.11.6-1",
      "1:10.11.6-2",
      "1:10.11.6-2.1~exp1",
      "1:10.11.7-1",
      "1:10.11.7-2",
      "1:10.11.7-3",
      "1:10.11.7-4",
      "1:10.11.8-1",
      "1:10.11.9-0+deb12u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48165.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "mariadb",
      "purl": "pkg:deb/debian/mariadb?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1:11.8.2-1",
      "1:11.8.3-0+deb13u1",
      "1:11.8.3-1",
      "1:11.8.5-1",
      "1:11.8.5-2",
      "1:11.8.5-3",
      "1:11.8.5-3~exp1",
      "1:11.8.5-3~exp2",
      "1:11.8.5-3~exp3",
      "1:11.8.5-4",
      "1:11.8.6-0+deb13u1",
      "1:11.8.6-1",
      "1:11.8.6-2",
      "1:11.8.6-3",
      "1:11.8.6-4",
      "1:11.8.6-5",
      "1:11.8.6-6",
      "1:11.8.8-0+deb13u1",
      "1:11.8.8-1",
      "1:11.8.9+ds-1",
      "1:11.8.9+ds-2",
      "1:11.8.9+ds-3",
      "1:11.8.9+ds-4"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48165.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:11.8.8-1"
          }
        ]
      }
    ],
    "package": {
      "name": "mariadb",
      "purl": "pkg:deb/debian/mariadb?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1:11.8.2-1",
      "1:11.8.3-1",
      "1:11.8.5-1",
      "1:11.8.5-2",
      "1:11.8.5-3",
      "1:11.8.5-3~exp1",
      "1:11.8.5-3~exp2",
      "1:11.8.5-3~exp3",
      "1:11.8.5-4",
      "1:11.8.6-1",
      "1:11.8.6-2",
      "1:11.8.6-3",
      "1:11.8.6-4",
      "1:11.8.6-5",
      "1:11.8.6-6"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48165.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #57174 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 17:04:46 GMT
Publisher date: Fri, 12 Jun 2026 18:16:35 GMT

Read the original announcement