Is CVE-2026-48772 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48772 being exploited in the wild.

How severe is CVE-2026-48772?

Critical severity, with a CVSS score of 10, published 19 June 2026.

Is there a fix for CVE-2026-48772?

A patch was published on 2026-06-04: Version 3.0.9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48772 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-48772?

Check whether you run ProxySQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48772: ProxySQL source IP spoofing and ACL bypass in PROXY protocol v1

CVE-2026-48772 · Severity: critical · CVSS 10 · Published 2026-06-19

ProxySQL, a high-performance proxy for MySQL and PostgreSQL databases, contains a vulnerability that allows attackers to spoof their identity. By sending a specially crafted network header, an attacker can trick the proxy into believing their connection is coming from a trusted internal IP address. This allows unauthorized users to bypass security rules, access restricted database schemas, or perform administrative actions that should be limited to specific network locations.

Technologies: ProxySQL. Vendors: ProxySQL.

Quick answers

Is CVE-2026-48772 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48772 being exploited in the wild.
How severe is CVE-2026-48772?: Critical severity, with a CVSS score of 10, published 19 June 2026.
Which products and versions are affected?: ProxySQL 2.0.0 - 3.0.8.
Is there a fix for CVE-2026-48772?: A patch was published on 2026-06-04: Version 3.0.9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48772 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-48772?: Check whether you run ProxySQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the ProxySQL MySQL frontend's handling of PROXY protocol v1 (PP1) frames. Specifically, when a frame uses the 'UNKNOWN' transport token, ProxySQL incorrectly uses sscanf to parse subsequent address fields instead of ignoring them as required by the HAProxy specification. The parsed spoofed address is then written into the session's internal address field, which is used by the query-rule matcher's 'client_addr' predicate. Because 'mysql-proxy_protocol_networks' defaults to '*', any network-reachable attacker can provide an arbitrary source IP in the PP1 header. This results in a complete bypass of ACLs, read-write splitting rules, and query filters pinned to specific client IP addresses. The issue is patched in version 3.0.9.

Affected products

sysown ProxySQL 2.0.0 - 3.0.8

Timeline

2026-05-26: advisory: GHSA-gw94-85m2-x8v2 published
2026-06-04: patched: Version 3.0.9 released
2026-06-19: disclosed: CVE-2026-48772 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.