Executive brief
MariaDB Server, a widely used database system, contains a security flaw in how it handles cluster synchronization. A malicious server joining a database cluster can trick an existing member of the cluster into executing unauthorized system commands. This could lead to a full takeover of the database server, potentially resulting in data theft or service disruption.
Technical details
An OS command injection vulnerability (CWE-78) exists in the `wsrep_sst_rsync.sh` script of MariaDB Server. The root cause is the improper neutralization of special characters in the `WSREP_SST_OPT_REMOTE_USER` and `WSREP_SST_OPT_REMOTE_PSWD` parameters provided by a joiner node during a State Snapshot Transfer (SST). When the rsync SST method is used, the donor node interpolates these values into configuration files (stunnel.conf and rsync magic files) without sufficient validation. An attacker with the high privileges required to initiate a joiner request can inject newlines or other shell metacharacters to execute arbitrary commands on the donor node. The issue is fixed in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2 by applying the `safe()` validation function to these parameters.
Affected products
- MariaDB MariaDB Server 10.6.1 to 10.6.26, 10.11.1 to 10.11.17, 11.4.1 to 11.4.11, 11.8.1 to 11.8.7, 12.3.1
Timeline
- 2026-05-18: other: Issue reported in MariaDB Jira (MDEV-39648)
- 2026-05-20: patched: Issue resolved in source code
- 2026-06-02: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE-2026-48163 published to NVD