Vulnerability in ProxySQL (CVE-2026-48772)
Summary
Vulnerability in ProxySQL (CVE-2026-48772). Confidential information can be exposed externally. Exploitable via UNKNOWN.
Original description
The description as published by the source.
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the PROXY UNKNOWN \r\n PP1 frame as a well-formed PROXY protocol header. The HAProxy PROXY protocol v1 specification says that when the protocol token is UNKNOWN, the receiver MUST ignore any address fields that follow it, because the proxy has declared it cannot determine the client identity. ProxySQL parses those address fields anyway via sscanf and writes the spoofed source address into the session's addr.addr field. From there it flows directly into the query-rule matcher, where the client_addr predicate decides routing and ACL. When mysql-proxy_protocol_networks = '*' (the default), any TCP peer can send a PP1 frame and choose any source IP claim. With that, any mysql_query_rules row pinned to a client_addr value is forgeable: the attacker writes the address they want to match into the PP1 line, and ProxySQL routes their query as if it came from that address. In practice this is a routing and ACL bypass. Real deployments use client_addr for read-write splitting (internal apps go to the primary, public traffic to read replicas), per-app schema pinning, and query-filter rules (DDL allowed only from admin CIDR, public queries blocked from dangerous patterns). An attacker that can reach the frontend port can forge their way into any of those routes. Version 3.0.9 patches this issue.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-48772 has been found in ProxySQL.
Attackers can target a specific entry point like UNKNOWN over the network to misuse the product.
Confidential information can be exposed externally. CVSS score: 10.0/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "ProxySQL CVE-2026-48772" on the vendor's site.
CVE-2026-48772 (ProxySQL) — CWE-348 / CVSS v3 10.0
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: UNKNOWN / sscanf / addr.addr / client_addr
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-348) exists in ProxySQL. Attackers reach the vulnerable code path via UNKNOWN without authentication.
Check the vendor advisory for the affected versions of ProxySQL. Attack surface: UNKNOWN / sscanf / addr.addr / client_addr.
Severity: Critical (CVSS 10.0/10). Confidential information can be exposed externally.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'ProxySQL' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'ProxySQL' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
ProxySQLを grep し、稼働しているサービス・バージョンを把握する。 -
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- web github.com