# CVE-2026-107819: MariaDB Connector/C certificate verification bypass in authentication

Source: https://junglewise.ai/threats/cve-2026-107819-mariadb-connector-c-is-a-c-and-c-client-library-for-connecting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107819 · Severity: medium · CVSS 5.9 · Published 2026-10-09

MariaDB Connector/C is a client library that applications use to connect to MariaDB and MySQL databases. An attacker positioned between a client and server can intercept the connection and present a valid TLS certificate for a different hostname, tricking the client into sending the database password in cleartext. This allows the attacker to obtain database credentials without the user knowing.

Vendors: [Mariadb](https://junglewise.ai/threats/vendors/mariadb).

## Quick answers

**Is CVE-2026-107819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107819 being exploited in the wild.

**How severe is CVE-2026-107819?** Medium severity, with a CVSS score of 5.9, published 9 October 2026.

**Which products and versions are affected?** Mariadb Connector/C 3.4.1 through 3.4.9.

**Is there a fix for CVE-2026-107819?** Yes: fixed in 3.4.10. Until then: Install properly signed certificates on the server, configure clients to accept only specific certificate fingerprints, delete mysql_clear_password.so and dialog.so files, or use the restricted-auth option to restrict authentication to safe plugins. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107819 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107819?** Check whether you run Mariadb Connector/C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.4.10

Install properly signed certificates on the server, configure clients to accept only specific certificate fingerprints, delete mysql_clear_password.so and dialog.so files, or use the restricted-auth option to restrict authentication to safe plugins.

## Technical details

The vulnerability exists in libmariadb's Zero-Configuration SSL authentication-switch logic (versions 3.4.1–3.4.9), where a bitwise AND check (`tls_verify_status & MARIADB_TLS_VERIFY_TRUST`) incorrectly treats hostname verification failures as acceptable for switching to cleartext password plugins like mysql_clear_password. An active network-based MITM attacker without authentication can present a valid certificate for another hostname and request the client switch to cleartext auth, extracting the password within the attacker-controlled TLS session.

## Affected products

- MariaDB Connector/C 3.4.1 through 3.4.9

## Timeline

- 2026-09-07: disclosed
- 2026: patched: Fixed in version 3.4.10
- 2026-10-09: advisory

## References

- [https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7](https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7)
- [https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02](https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02)

## Related threats

- [Progressive Robot hMailServer TLS CA file bypass](https://junglewise.ai/threats/cve-2026-126610-progressive-robot-hmailserver-6-3-4-through-6-3-7-with-a-mysql)