CVE-2026-55215: MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.

CVE-2026-55215 · Severity: high · CVSS 7.5 · Published 2026-08-28

MariaDB Connector for Node.js is a database driver used by applications to connect to MariaDB servers. When SSL/TLS is enabled without providing a CA certificate, the connector delays server identity validation until after the authentication exchange, allowing a network attacker to intercept and capture login credentials in cleartext before the connection is rejected.

Technologies: Mariadb Connector/Node.js, mariadb (npm). Vendors: Mariadb, npm.

Quick answers

Is CVE-2026-55215 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55215 being exploited in the wild.
How severe is CVE-2026-55215?
High severity, with a CVSS score of 7.5, published 28 August 2026.
Which products and versions are affected?
Mariadb Connector/Node.js < 3.2.4, >= 3.3.0 < 3.3.3, >= 3.4.0 < 3.4.6, >= 3.5.0 < 3.5.3; mariadb (npm) SEMVER:introduced=0,fixed=3.2.4.
Is there a fix for CVE-2026-55215?
Yes. mariadb (npm): upgrade to 3.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55215 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55215?
Check whether you run Mariadb Connector/Node.js or mariadb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mariadb (npm): upgrade to 3.2.4 or later
    npm install mariadb@3.2.4

Technical details

The vulnerability is a credential disclosure flaw (CWE-522, CWE-295) in MariaDB Connector/Node.js's SSL/TLS handling. When configured with SSL enabled but no pinned CA certificate, the connector trusts self-signed certificates and defers identity validation via certificate fingerprint until after the authentication exchange. Two attack paths exist: (1) if the server negotiates mysql_clear_password as the initial authentication plugin, credentials are sent before fingerprint validation; (2) during authentication plugin switching, the connector checks the previous plugin instead of the target plugin, allowing a bypass if switching from a benign plugin to mysql_clear_password. An on-path attacker presenting any self-signed certificate can harvest the password in cleartext before the fingerprint check fails and closes the connection. The disclosed credentials can then be used for direct server authentication. Patches enforce identity validation before credential transmission and correct plugin-checking logic.

Affected products

  • MariaDB Connector/Node.js < 3.2.4, >= 3.3.0 < 3.3.3, >= 3.4.0 < 3.4.6, >= 3.5.0 < 3.5.3

Identifiers

  • CVE-2026-55215
  • GHSA-cqhc-2h57-wpxf

Timeline

  • 2026-07-09: disclosed: Published to GitHub Advisory Database
  • 2026-06-09: patched: Fixed in 3.3.3 (released); also patched in 3.2.4, 3.4.6, 3.5.3
  • 2026-08-28: advisory: Updated/reviewed by GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.