CVE-2026-48772: ProxySQL Auth Bypass Vulnerability

CVE-2026-48772 Overview

CVE-2026-48772 is a source-address spoofing vulnerability in ProxySQL, a high-performance proxy for MySQL, its forks, and PostgreSQL. Versions 2.0.0 through 3.0.8 incorrectly parse HAProxy PROXY protocol v1 (PP1) frames that use the UNKNOWN token. The PP1 specification mandates that receivers ignore address fields when the protocol token is UNKNOWN. ProxySQL instead reads those fields with sscanf and stores the attacker-supplied address in the session's addr.addr field. That value flows into the client_addr predicate of mysql_query_rules, allowing an unauthenticated network attacker to forge any source IP and bypass routing and access control logic. The flaw is classified under CWE-348 (Use of Less Trusted Source).

Critical Impact
Any TCP peer able to reach the ProxySQL frontend port can forge an arbitrary source IP and bypass client_addr-based query rules, including read-write splitting, schema pinning, and DDL ACLs.

Affected Products

ProxySQL versions 2.0.0 through 3.0.8
Deployments using mysql-proxy_protocol_networks = '*' (the default)
Any environment relying on client_addr in mysql_query_rules for routing or ACL enforcement

Discovery Timeline

2026-06-19 - CVE-2026-48772 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-48772

Vulnerability Analysis

The vulnerability resides in ProxySQL's MySQL frontend PROXY protocol v1 parser. When a client connects and sends a PP1 header of the form PROXY UNKNOWN <addr> <addr> <port> <port>\r\n, ProxySQL treats it as a well-formed frame and extracts the address fields. The HAProxy PP1 specification explicitly states that the UNKNOWN token signals the upstream proxy cannot determine the client identity, and receivers must discard any trailing address data. ProxySQL violates that contract by calling sscanf against the rest of the frame and copying the parsed value into addr.addr.

That session attribute is consumed by the query-rule matcher. Rules in mysql_query_rules that pin behavior to a client_addr predicate make routing and ACL decisions using the spoofed value. The result is a routing and access-control bypass exploitable by any unauthenticated peer that can reach the frontend port.

Root Cause

The root cause is improper trust in input data when the protocol explicitly declares it untrusted. ProxySQL does not branch on the protocol token before parsing the address fields. The UNKNOWN keyword should cause the parser to discard the remaining tokens, but the implementation parses them unconditionally and assigns the result to the session source address.

Attack Vector

The attack is fully remote and unauthenticated. With mysql-proxy_protocol_networks set to '*', ProxySQL accepts PP1 frames from any peer. An attacker constructs a PP1 line with the UNKNOWN token followed by the IP address they want the rule engine to observe, then sends their MySQL traffic over the same connection. ProxySQL routes the subsequent queries as if they originated from the forged address. This enables read-write split abuse, schema pinning bypass, exposure of DDL paths reserved for admin CIDRs, and circumvention of public-traffic query filters.

No verified exploit code is published. See the GitHub Security Advisory GHSA-gw94-85m2-x8v2 for vendor technical details.

Detection Methods for CVE-2026-48772

Indicators of Compromise

PP1 frames containing the literal token PROXY UNKNOWN followed by address fields arriving on the ProxySQL MySQL frontend port
Connections from peer IPs whose claimed PP1 source address does not match the TCP source address recorded by the network layer
Query routing decisions or mysql_query_rules matches attributed to internal or admin CIDRs from connections originating outside those ranges

Detection Strategies

Capture network traffic to the ProxySQL frontend port and alert on PP1 headers that begin with PROXY UNKNOWN
Correlate ProxySQL session logs containing addr.addr values with firewall or load balancer logs of the true TCP peer to identify mismatches
Audit mysql_query_rules matches for queries hitting admin-only or primary-only rules from sessions whose underlying TCP peer is outside the trusted CIDR

Monitoring Recommendations

Forward ProxySQL access and query logs to a centralized SIEM and enrich them with the upstream TCP peer address
Monitor for spikes in DDL statements, sensitive schema access, or write traffic routed via client_addr rules
Track ProxySQL version inventory and alert on any instance running 2.0.0 through 3.0.8

How to Mitigate CVE-2026-48772

Immediate Actions Required

Upgrade ProxySQL to version 3.0.9, which patches the PP1 UNKNOWN parsing behavior
Restrict mysql-proxy_protocol_networks to the specific CIDRs of trusted upstream proxies instead of the default '*'
Audit mysql_query_rules for any rule that relies on client_addr for routing, schema pinning, or ACL enforcement
Place ProxySQL frontend ports behind network segmentation that limits exposure to known upstream load balancers

Patch Information

ProxySQL 3.0.9 corrects the PP1 parser so that the UNKNOWN token causes the address fields to be ignored, matching the HAProxy PROXY protocol v1 specification. Release details are available in the ProxySQL v3.0.9 release notes and the GitHub Security Advisory GHSA-gw94-85m2-x8v2.

Workarounds

Set mysql-proxy_protocol_networks to an explicit allowlist of trusted proxy source addresses to block PP1 frames from arbitrary peers
Disable PROXY protocol support entirely if no upstream load balancer requires it
Replace client_addr-based query rules with authentication-derived predicates such as user, schema, or hostgroup until patched

bash

# Restrict PROXY protocol acceptance to trusted upstream load balancers
UPDATE global_variables
  SET variable_value='10.0.0.10/32,10.0.0.11/32'
  WHERE variable_name='mysql-proxy_protocol_networks';
LOAD MYSQL VARIABLES TO RUNTIME;
SAVE MYSQL VARIABLES TO DISK;