Is CVE-2026-107819 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107819 being exploited in the wild.

How severe is CVE-2026-107819?

Medium severity, with a CVSS score of 5.9, published 9 October 2026.

Which products and versions are affected?

Mariadb Connector/C 3.4.1 through 3.4.9.

How is CVE-2026-107819 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107819?

Check whether you run Mariadb Connector/C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107819: MariaDB Connector/C certificate verification bypass in authentication

CVE-2026-107819 · Severity: medium · CVSS 5.9 · Published 2026-10-09

MariaDB Connector/C is a client library that applications use to connect to MariaDB and MySQL databases. An attacker positioned between a client and server can intercept the connection and present a valid TLS certificate for a different hostname, tricking the client into sending the database password in cleartext. This allows the attacker to obtain database credentials without the user knowing.

Vendors: Mariadb.

Quick answers

Is CVE-2026-107819 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107819 being exploited in the wild.
How severe is CVE-2026-107819?: Medium severity, with a CVSS score of 5.9, published 9 October 2026.
Which products and versions are affected?: Mariadb Connector/C 3.4.1 through 3.4.9.
Is there a fix for CVE-2026-107819?: Yes: fixed in 3.4.10. Until then: Install properly signed certificates on the server, configure clients to accept only specific certificate fingerprints, delete mysql_clear_password.so and dialog.so files, or use the restricted-auth option to restrict authentication to safe plugins. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107819 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107819?: Check whether you run Mariadb Connector/C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.4.10

Install properly signed certificates on the server, configure clients to accept only specific certificate fingerprints, delete mysql_clear_password.so and dialog.so files, or use the restricted-auth option to restrict authentication to safe plugins.

Technical details

The vulnerability exists in libmariadb's Zero-Configuration SSL authentication-switch logic (versions 3.4.1–3.4.9), where a bitwise AND check (`tls_verify_status & MARIADB_TLS_VERIFY_TRUST`) incorrectly treats hostname verification failures as acceptable for switching to cleartext password plugins like mysql_clear_password. An active network-based MITM attacker without authentication can present a valid certificate for another hostname and request the client switch to cleartext auth, extracting the password within the attacker-controlled TLS session.

Affected products

MariaDB Connector/C 3.4.1 through 3.4.9

Timeline

2026-09-07: disclosed
2026: patched: Fixed in version 3.4.10
2026-10-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.