CVE-2026-48772: Critical Routing and Access-Control Bypass

How to Detect It

Detection is mainly about spotting impossible or suspicious client identity transitions. If ProxySQL is expected to receive PROXY protocol traffic only from a specific upstream load balancer, then any direct connection carrying a PROXY line from another source should be treated as suspicious. Likewise, if application traffic suddenly appears to originate from internal or allowlisted subnets that do not match your network path, investigate immediately.

You should also review whether mysql_query_rules use client_addr in security-sensitive ways. The flaw becomes materially dangerous when source IP controls routing or authorization. In many environments, detection will require combining network telemetry, ProxySQL admin-plane review, and backend query attribution to catch mismatches between the actual TCP peer and the client address ProxySQL appears to use for rule matching.

Technical Notes

Start by checking whether the risky configuration is present:

SELECT variable_name, variable_value
FROM global_variables
WHERE variable_name = 'mysql-proxy_protocol_networks';

Review rules that depend on client source:

SELECT rule_id, active, username, client_addr, destination_hostgroup, apply
FROM mysql_query_rules
WHERE client_addr IS NOT NULL AND client_addr <> '';

At the network layer, look for PROXY protocol v1 lines containing UNKNOWN followed by address fields. A simple Suricata-style content concept for review is:

alert tcp any any -> $PROXYSQL_SERVERS 6033 (
  msg:"Possible CVE-2026-48772 probe: PROXY UNKNOWN with address fields";
  flow:to_server,established;
  content:"PROXY UNKNOWN "; depth:14;
  sid:10048772; rev:1;
)

If you collect raw TCP payload metadata or IDS events, hunt for this pattern:

PROXY UNKNOWN [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ [0-9]+ [0-9]+\n```

If ProxySQL logs do not expose enough detail in your environment, compare the actual source IP seen by perimeter devices with the source context used for database access decisions. A discrepancy between those data points is a strong indicator of abuse or misconfiguration.

## Mitigation and Patching

The primary fix is to upgrade from affected versions `2.0.0 through 3.0.8` to `3.0.9` or later. Because the vulnerability concerns how ProxySQL parses and trusts frontend identity information, configuration hardening should accompany patching. Specifically, review whether `mysql-proxy_protocol_networks` is overly permissive and whether `client_addr` is being used as a hard trust signal for authorization or routing.

If you cannot patch immediately, reduce exposure by limiting which upstream systems are permitted to speak PROXY protocol to ProxySQL. Do not leave acceptance effectively open to any peer if your architecture only needs one or two load balancers to provide that header. Also review whether `client_addr`-based rules can be replaced, narrowed, or temporarily disabled until patched.

### Technical Notes

First, identify your running version:

```bash
proxysql --version

If you manage ProxySQL through your package repository, use the package manager appropriate to your platform after confirming 3.0.9 is available in your approved source. Example workflow on Debian-derived systems:

apt-cache policy proxysql
sudo apt-get update
sudo apt-get install proxysql=3.0.9*

Example workflow on RHEL-derived systems:

dnf info proxysql
sudo dnf upgrade proxysql

Because package naming and repository availability differ by environment, verify that the resulting installed version is actually 3.0.9 or later rather than assuming the upgrade succeeded.

If you need an interim hardening step, restrict PROXY protocol networks from the default broad setting. Check the current value:

SELECT variable_value
FROM global_variables
WHERE variable_name='mysql-proxy_protocol_networks';

Then set it to only the expected load balancer subnet or host range, replacing the example below with your real source network:

UPDATE global_variables
SET variable_value='192.0.2.0/24'
WHERE variable_name='mysql-proxy_protocol_networks';

LOAD MYSQL VARIABLES TO RUNTIME;
SAVE MYSQL VARIABLES TO DISK;

Also audit client_addr rules and remove or narrow those that grant privileged routing based solely on source IP:

SELECT rule_id, active, client_addr, destination_hostgroup
FROM mysql_query_rules
WHERE client_addr IS NOT NULL AND client_addr <> '';

References

• NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-48772
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• ProxySQL v3.0.9 release: https://github.com/sysown/proxysql/releases/tag/v3.0.9
• GitHub Security Advisory: https://github.com/sysown/proxysql/security/advisories/GHSA-gw94-85m2-x8v2

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.