CVE-2026-48165 is an OS command injection vulnerability (CWE-78) in MariaDB server affecting versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and version 12.3.1. A high-privileged MariaDB user can manipulate the global system variables wsrep_sst_receive_address or wsrep_sst_donor to execute arbitrary shell commands with the privileges of the mariadbd process on a Galera joiner node. This leads to arbitrary code execution, allowing attackers to compromise confidentiality, integrity, and availability of the system. The vulnerability has been officially fixed in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. Red Hat has issued advisories and patches for affected products, recommending upgrading to fixed versions.

Successful exploitation allows a high-privileged MariaDB user to execute arbitrary operating system shell commands as the mariadbd process user on a Galera joiner node. This can lead to full system compromise including unauthorized code execution, data modification, data disclosure, and denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected systems.

An official fix is available. Users should upgrade affected MariaDB server versions to 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2 or later. Red Hat customers should apply the security updates provided in RHSA-2026:33093 or later errata. No vendor advisory states that no action is required or that the issue is already mitigated. Applying the official patches is the recommended remediation.