Junglewise Threat Intelligence

CVE-2026-55215: MariaDB Connector/Node.js cleartext password disclosure to MitM

CVE-2026-55215 · Severity: high · CVSS 7.5 · Published 2026-08-28

Executive brief

MariaDB Connector for Node.js is a database driver used by applications to connect to MariaDB servers. When SSL/TLS is enabled without providing a CA certificate, the connector delays server identity validation until after the authentication exchange, allowing a network attacker to intercept and capture login credentials in cleartext before the connection is rejected.

Technical details

The vulnerability is a credential disclosure flaw (CWE-522, CWE-295) in MariaDB Connector/Node.js's SSL/TLS handling. When configured with SSL enabled but no pinned CA certificate, the connector trusts self-signed certificates and defers identity validation via certificate fingerprint until after the authentication exchange. Two attack paths exist: (1) if the server negotiates mysql_clear_password as the initial authentication plugin, credentials are sent before fingerprint validation; (2) during authentication plugin switching, the connector checks the previous plugin instead of the target plugin, allowing a bypass if switching from a benign plugin to mysql_clear_password. An on-path attacker presenting any self-signed certificate can harvest the password in cleartext before the fingerprint check fails and closes the connection. The disclosed credentials can then be used for direct server authentication. Patches enforce identity validation before credential transmission and correct plugin-checking logic.

Affected products

  • MariaDB Connector/Node.js < 3.2.4, >= 3.3.0 < 3.3.3, >= 3.4.0 < 3.4.6, >= 3.5.0 < 3.5.3

Timeline

  • 2026-07-09: disclosed: Published to GitHub Advisory Database
  • 2026-06-09: patched: Fixed in 3.3.3 (released); also patched in 3.2.4, 3.4.6, 3.5.3
  • 2026-08-28: advisory: Updated/reviewed by GitHub Advisory Database

References

Related threats