dbcve.org
ProxysqlApplication

CVE-2026-48772

CRITICAL · 10.0 CVSS v3.1 Published 2026-06-19
Fix available
A fix is available. Upgrade to 3.0.9 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the `PROXY UNKNOWN <addr> <addr> <port> <port>\r\n` PP1 frame as a well-formed PROXY protocol header. The HAProxy PROXY protocol v1 specification says that when the protocol token is `UNKNOWN`, the receiver MUST ignore any address fields that follow it, because the proxy has declared it cannot determine the client identity. ProxySQL parses those address fields anyway via `sscanf` and writes the spoofed source address into the session's `addr.addr` field. From there it flows directly into the query-rule matcher, where the `client_addr` predicate decides routing and ACL. When `mysql-proxy_protocol_networks = '*'` (the default), any TCP peer can send a PP1 frame and choose any source IP claim. With that, any `mysql_query_rules` row pinned to a `client_addr` value is forgeable: the attacker writes the address they want to match into the PP1 line, and ProxySQL routes their query as if it came from that address. In practice this is a routing and ACL bypass. Real deployments use `client_addr` for read-write splitting (internal apps go to the primary, public traffic to read replicas), per-app schema pinning, and query-filter rules (DDL allowed only from admin CIDR, public queries blocked from dangerous patterns). An attacker that can reach the frontend port can forge their way into any of those routes. Version 3.0.9 patches this issue.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

ProxySQL versions 2.0.0-3.0.8 incorrectly parse HAProxy PROXY protocol v1 headers, accepting spoofed source addresses even when the protocol token is UNKNOWN. Attackers can send a crafted PP1 frame claiming any source IP, bypassing client_addr-based routing rules, ACLs, read-write splitting, and query-filter rules when mysql-proxy_protocol_networks defaults to '*'. This enables routing and ACL bypass for any TCP peer that can reach the ProxySQL frontend port.

MitigationUpgrade to ProxySQL 3.0.9 or later to patch the PROXY protocol parsing vulnerability. Additionally, restrict mysql-proxy_protocol_networks to specific trusted CIDRs rather than '*' as a defense-in-depth measure.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
ProxysqlApplication
Affected:>= 2.0.0, < 3.0.9

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify ProxySQL version
    Run 'mysql -u admin -p -h 127.0.0.1 -P 6032 -e "SELECT @@version;"' or check the binary with 'proxysql --version'
    Affected if The installed version falls within 2.0.0 through 3.0.8 (inclusive)
  2. Check mysql-proxy_protocol_networks setting
    Connect to ProxySQL admin port and execute: 'SELECT variable_name, variable_value FROM global_variables WHERE variable_name = "mysql-proxy_protocol_networks";'
    Affected if The value is '*' or contains a wildcard, indicating all networks are trusted for PROXY protocol
  3. Verify PROXY protocol is enabled
    Query global_variables for 'mysql-proxy_protocol' to confirm the protocol handler is active: 'SELECT variable_value FROM global_variables WHERE variable_name = "mysql-proxy_protocol";'
    Affected if The value is set to '1' or 'true', meaning PROXY protocol handling is enabled in the frontend
  4. Confirm exposed frontend port accessibility
    Review netstat or ss output for ProxySQL listener on port 3306 (or configured frontend port) to determine if the service is network-reachable from untrusted sources
    Affected if The ProxySQL frontend port is bound to a non-localhost interface and is accessible from network segments containing untrusted peers

You are affected if ProxySQL version is between 2.0.0 and 3.0.8, mysql-proxy_protocol_networks is set to '*', and the frontend port is network-accessible from untrusted sources.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 3.0.9 or later
Fixed in 3.0.9
Interim mitigation

Upgrade to ProxySQL 3.0.9 or later to patch the PROXY protocol parsing vulnerability. Additionally, restrict mysql-proxy_protocol_networks to specific trusted CIDRs rather than '*' as a defense-in-depth measure.

Recommended fix High confidence

ProxySQL 3.0.9

  1. 1. Back up your current ProxySQL configuration and database.
  2. 2. Download ProxySQL version 3.0.9 or later from the official ProxySQL GitHub releases (github.com/proxysql/proxysql).
  3. 3. Stop the running ProxySQL service.
  4. 4. Install the new version (3.0.9) using your system's package manager or compile from source.
  5. 5. Verify the installation by checking the ProxySQL version: `proxysql --version`.
  6. 6. Start the ProxySQL service.
  7. 7. Test that legitimate MySQL connections work correctly through ProxySQL.
  8. 8. If you were relying on the vulnerable behavior, verify that your query rules using `client_addr` now work as expected with legitimate source addresses.

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Proxysql Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing4.0 h
  • Review / QA2.0 h
12.0 hours of engineering $2,080
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,328.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-48772 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-48772 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data