CVE Intelligence
Analysis AI-assisted

CVE-2026-48772: ProxySQL: PROXY Protocol Header Spoofing Bypasses client_addr Routing and ACLs

ProxySQL versions 2.0.0 through 3.0.8 accept a forged PROXY protocol header on the MySQL frontend and use the spoofed source address for query routing and ACL decisions. With the default network setting, any peer that can reach the frontend port can claim a chosen client IP. The record identifies version 3.0.9 as the patched release.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-48772 affects ProxySQL, a proxy for MySQL and its forks as well as PostgreSQL. According to the GitHub Security Advisory, the MySQL frontend accepts a PROXY protocol header whose UNKNOWN token should cause the following address fields to be ignored, but ProxySQL parses them and uses the claimed source address when matching query rules.

Impact

  • A network peer that can reach the frontend port can influence the client address seen by query rules.
  • Rules based on client_addr for read-write splitting, schema pinning or query filtering can be bypassed, which may send traffic to unintended backends or allow queries that should be blocked.
  • The GitHub-provided CVSS 3.1 base score is 10, with high confidentiality and integrity impact and no availability impact, as listed in the NVD entry.

Affected products and versions

  • The description states that versions 2.0.0 through 3.0.8 are affected.
  • The structured range in the record is 2.0.0 or later and before 3.0.9.
  • By default, mysql-proxy_protocol_networks is set to '*', which accepts PROXY headers from any TCP peer.
  • Whether other maintained branches receive backported fixes is not stated in the record.

Exploitation status

The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog. No confirmed active exploitation appears in the sources consulted for this analysis. One reference is tagged 'Exploit' in the record, but this analysis does not treat that tag as evidence of exploitation in the wild.

Remediation and mitigation

  • Upgrade ProxySQL to version 3.0.9, which the record identifies as the patched release, per the release notes.
  • If an upgrade cannot happen immediately, restrict which networks can reach the MySQL frontend port using network segmentation and firewall rules.
  • Limit the PROXY protocol trust setting to the known load balancers or proxies that legitimately send these headers, instead of accepting any peer.
  • Do not rely solely on client_addr rules for security-critical routing or access decisions until the system is patched.

Detection guidance

  • Review frontend connection logs for PROXY protocol headers arriving from peers that are not known load balancers.
  • Compare the client addresses recorded by ProxySQL with the actual TCP source addresses to spot mismatches.
  • Watch for unexpected query routing or rule hits on rules scoped to internal or administrative address ranges.

Limitations of the available information

  • The record provides only one CVSS score, from the GitHub advisory provider; no other provider scores are present.
  • EPSS and SSVC data are not available.
  • The CWE name is missing, although the identifier CWE-348 is given.
  • Fixed versions for branches other than 3.0.x are not stated, and no vendor-verified workaround is described beyond the patch.

Frequently asked questions

Is CVE-2026-48772 known to be actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

Which ProxySQL version fixes this issue?

The record identifies version 3.0.9 as the patched release. Fixes for other branches are not stated in the record.

Does the default configuration increase exposure?

Yes. The default mysql-proxy_protocol_networks value of '*' accepts PROXY headers from any TCP peer, so restricting that setting to trusted proxies reduces exposure.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.