Executive brief
ProxySQL, a high-performance proxy for MySQL and PostgreSQL databases, contains a vulnerability that allows attackers to spoof their identity. By sending a specially crafted network header, an attacker can trick the proxy into believing their connection is coming from a trusted internal IP address. This allows unauthorized users to bypass security rules, access restricted database schemas, or perform administrative actions that should be limited to specific network locations.
Technical details
A vulnerability exists in the ProxySQL MySQL frontend's handling of PROXY protocol v1 (PP1) frames. Specifically, when a frame uses the 'UNKNOWN' transport token, ProxySQL incorrectly uses sscanf to parse subsequent address fields instead of ignoring them as required by the HAProxy specification. The parsed spoofed address is then written into the session's internal address field, which is used by the query-rule matcher's 'client_addr' predicate. Because 'mysql-proxy_protocol_networks' defaults to '*', any network-reachable attacker can provide an arbitrary source IP in the PP1 header. This results in a complete bypass of ACLs, read-write splitting rules, and query filters pinned to specific client IP addresses. The issue is patched in version 3.0.9.
Affected products
- sysown ProxySQL 2.0.0 - 3.0.8
Timeline
- 2026-05-26: advisory: GHSA-gw94-85m2-x8v2 published
- 2026-06-04: patched: Version 3.0.9 released
- 2026-06-19: disclosed: CVE-2026-48772 published to NVD